Python Sdk Best Practices

• Outcome: Pass
• Latest audit: May 29, 2026, 8:44 PM
• Version:
  1.0.0

Overview

This is a documentation-only Bright Data SDK guide with disclosed scraping and account-management examples, so it is allowed but should be used carefully.

Install only if you intend to generate or review Bright Data SDK code. Before running generated examples, confirm scraping is authorized, keep API and browser credentials out of source code, review billing impact, and require explicit confirmation for zone creation, zone deletion, dataset exports, and browser automation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The skill is framed as coding guidance, but it includes account-mutating zone management operations such as listing and deleting zones. In an agent setting, this expands the skill from passive code help into potentially destructive account administration, which could lead an LLM to generate or suggest destructive actions unrelated to the user's request.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The client configuration section documents auto-creation of zones and states that the SDK may create account resources by default. For a skill marketed as best practices for writing SDK code, silently normalizing account-modifying behavior can cause unintended resource creation, billing, or privilege use when an agent follows the guidance automatically.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Including `delete_zone` in a broad coding-assistance skill is not justified by the stated purpose and exposes a destructive account operation to downstream agent use. If surfaced without strong guardrails, an LLM could propose deletion during debugging or cleanup, causing service disruption or loss of configuration.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill covers web scraping, SERP queries, datasets, browser automation, file export, and destructive account actions without user-facing warnings about privacy, legal/compliance concerns, data transmission to third parties, file writes, or account mutations. In an agent environment, the absence of these guardrails increases the chance of unsafe automation and actions that exceed user expectations.

VirusTotal

64/64 vendors flagged this skill as clean.