xcrawl-map
Pass
Audited by Gen Agent Trust Hub on Mar 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Executes
curlandnodecommands via the Bash tool to perform API requests to the XCrawl service. - [DATA_EXFILTRATION]: Accesses the local configuration file at
~/.xcrawl/config.jsonto read the user'sXCRAWL_API_KEYfor authentication. - [EXTERNAL_DOWNLOADS]: Communicates with the external API at
https://run.xcrawl.comto perform URL mapping tasks. - [DATA_EXFILTRATION]: Sends the retrieved API key in the Authorization header to the external XCrawl service as part of the request flow.
- [INDIRECT_PROMPT_INJECTION]: Ingests and returns raw data from an external API, creating a surface for potential indirect instructions.
- Ingestion points: Data returned from the
https://run.xcrawl.com/v1/mapendpoint. - Boundary markers: Absent; the skill is designed to return raw upstream API responses.
- Capability inventory: Uses the Bash tool for
curlandnodecommand execution. - Sanitization: Absent; the skill performs raw passthrough of the API response body.
Audit Metadata