How learning stays safe
What Skavelo does, and doesn't do, when it reads your sites and your app.
Learning is read-only by design. Skavelo reads pages much like a search engine does, with a few extra precautions for signed-in apps.
What Skavelo does
- Opens the address you entered and follows links on the same domain, up to your page limit.
- Signs in with your test account, if you added one.
- In your web app, opens menus, tabs and dialogs to see what's behind them, such as the menu behind a row's More button.
- Reads the text, buttons, links and fields on each screen.
What Skavelo doesn't do
- Change your data. While it explores your web app, every request that isn't a read is blocked in the browser before it leaves, and so is every message the page sends over a websocket. Nothing is saved, sent or deleted.
- Click actions. It never clicks a control whose label sounds like an action, such as save, send, delete, pause, pay, confirm or log out, nor a submit button, nor anything inside a menu or dialog it opened. It only opens and looks.
- Ignore your robots.txt. Pages your
robots.txtasks crawlers to avoid are skipped. - Leave your domain. It only follows links on the domain you entered.
- Reach private networks. It can't be pointed at internal addresses such as
localhostor private IP ranges, including through redirects.
Skavelo identifies itself as SkaveloBot when it reads your site.
Your test account
- Use a dedicated test account, ideally on staging, with sample data rather than real customer data.
- The password is encrypted when you save it, used only to sign in during learning, and never shown again in the dashboard.
- Give the account the permissions a typical user has, so Skavelo learns the screens your users see.
Removing what Skavelo learned
Deleting a website on the Learning tab removes everything learned from it. Deleting a file or note removes its knowledge immediately. Deleting an agent removes all of its knowledge, its product map, skills and conversations.