web-scraper
Pass
Audited by Gen Agent Trust Hub on Mar 12, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill communicates with api.firecrawl.dev, which is the official endpoint for a well-known technology service. It uses the shift-local-gateway for invocation and manages sensitive API keys via secure slots in agent-secrets.yaml, ensuring credentials are never exposed in the conversation or code.
- [PROMPT_INJECTION]: The skill handles untrusted data from external websites through its scrape and crawl actions. The risk of indirect prompt injection is mitigated by the skill's design, which focuses on extracting content into structured JSON or markdown and does not provide the agent with capabilities for command execution or sensitive file access.
Audit Metadata