sg-property-scraper

• Analyzed: May 12, 2026, 4:17 AM
• Findings: 1
• Version: 1.0.1
• Hash: 1335939826e9a14592c0a625bef33c3e2f639fe8c08a0584ec1fb4efdf1d78e9
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `scripts/scrape.py` file contains a local file inclusion (LFI) vulnerability. The `--config` command-line argument allows specifying an arbitrary file path, which the script then attempts to open and parse as JSON. This could be exploited via prompt injection against the AI agent to read sensitive local files (e.g., `/etc/passwd`, `~/.ssh/id_rsa`), even if the JSON parsing fails, as the file read itself is an information disclosure risk. Additionally, the `--raw-param` argument allows adding arbitrary URL query parameters, which could be used to target the scraped website with injection attacks.