ClawHub
Back to skill

Security audit

MrScraper

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward MrScraper API integration, but users should treat all submitted URLs, scraping instructions, cookies, and scraped results as data shared with a third-party service.

Install only if you are comfortable sending target URLs, extraction prompts, workflow definitions, and scraped content to MrScraper. Avoid secrets, private/internal systems, authenticated pages, cookies, regulated data, and large bulk URL lists unless your organization has approved that third-party processing and retention.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (17)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill clearly sends user-supplied URLs, extraction instructions, and resulting scraped content to a third-party service, but the introductory description does not prominently warn users that potentially sensitive data may leave the local environment. This can lead to accidental disclosure of internal URLs, business data, or regulated content because users may treat the skill like a local scraping utility rather than an external SaaS integration.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The unblocker section mentions cookies and session-specific content but does not explicitly warn that sending such material through the service may expose authenticated pages, account data, or session context to a third party. Because this endpoint is designed to bypass anti-bot protections, misuse with authenticated sessions materially increases privacy and compliance risk.

Whitespace Padding

Medium
Category
Prompt Injection
Content
#### Payload parameters (for `agent`: `map`):

| Field             | Type     | Required | Default   | Description                                                                                                   |
| ----------------- | -------- | -------- | --------- | ------------------------------------------------------------------------------------------------------------- |
| `url`             | `string` | Yes      | —         | Target URL                                           |
| `agent`           | `string` | No       | map       | The AI agent type to use for scraping (for this case it is `map`)                                             |
Confidence
70% confidence
Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#### Request example:

```bash
curl -X POST "https://api.app.mrscraper.com/api/v1/scrapers-ai" \
  -H "x-api-token: <MRSCRAPER_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
88% confidence
Finding
This example documents transmission of user-provided URLs and extraction instructions to an external API, which can include sensitive content or internal targets. In the context of an agent skill, the risk is not the outbound request itself but that the skill can facilitate unreviewed disclosure of data to a third-party scraping provider.

External Transmission

Medium
Category
Data Exfiltration
Content
#### Request example:

```bash
curl -X POST "https://api.app.mrscraper.com/api/v1/scrapers-ai" \
  -H "x-api-token: <MRSCRAPER_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
88% confidence
Finding
This example documents transmission of user-provided URLs and extraction instructions to an external API, which can include sensitive content or internal targets. In the context of an agent skill, the risk is not the outbound request itself but that the skill can facilitate unreviewed disclosure of data to a third-party scraping provider.

External Transmission

Medium
Category
Data Exfiltration
Content
#### Request example:

```bash
curl -X POST "https://api.app.mrscraper.com/api/v1/scrapers-ai-rerun" \
  -H "accept: application/json" \
  -H "x-api-token: <MRSCRAPER_API_TOKEN>" \
  -H "Content-Type: application/json" \
Confidence
87% confidence
Finding
Rerun requests transmit new target URLs to the external service and may apply previously defined scraping behavior to sensitive pages without fresh review. This creates a data-exfiltration and privacy risk if users rerun scrapers against private, internal, or authenticated resources.

External Transmission

Medium
Category
Data Exfiltration
Content
#### Request example:

```bash
curl -X POST "https://api.app.mrscraper.com/api/v1/scrapers-ai-rerun" \
  -H "accept: application/json" \
  -H "x-api-token: <MRSCRAPER_API_TOKEN>" \
  -H "Content-Type: application/json" \
Confidence
87% confidence
Finding
Rerun requests transmit new target URLs to the external service and may apply previously defined scraping behavior to sensitive pages without fresh review. This creates a data-exfiltration and privacy risk if users rerun scrapers against private, internal, or authenticated resources.

External Transmission

Medium
Category
Data Exfiltration
Content
#### Request example:

```bash
curl -X POST "https://api.app.mrscraper.com/api/v1/scrapers-ai-rerun/bulk" \
  -H "x-api-token: " \
  -H "Content-Type: application/json" \
  -d '{
Confidence
84% confidence
Finding
Bulk reruns amplify the same third-party transmission risk by allowing many URLs to be sent in one operation, increasing the blast radius of mistakes or misuse. If internal or sensitive URLs are included, the service can receive a large volume of protected targets and extracted content at once.

External Transmission

Medium
Category
Data Exfiltration
Content
#### Request example:

```bash
curl -X POST "https://api.app.mrscraper.com/api/v1/scrapers-ai-rerun/bulk" \
  -H "x-api-token: " \
  -H "Content-Type: application/json" \
  -d '{
Confidence
84% confidence
Finding
Bulk reruns amplify the same third-party transmission risk by allowing many URLs to be sent in one operation, increasing the blast radius of mistakes or misuse. If internal or sensitive URLs are included, the service can receive a large volume of protected targets and extracted content at once.

Whitespace Padding

Medium
Category
Prompt Injection
Content
#### Payload parameters:

| Field        | Type           | Required | Default | Description                                                                                                      |
|--------------|----------------|----------|---------|------------------------------------------------------------------------------------------------------------------|
| `scraperId`  | `string`       | Yes      | —       | ID of the manual scraper to rerun.                                                                               |
| `url`        | `string`       | Yes      | —       | Target URL for the rerun.                                                                                        |
Confidence
70% confidence
Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium
Category
Prompt Injection
Content
| Field        | Type           | Required | Default | Description                                                                                                      |
|--------------|----------------|----------|---------|------------------------------------------------------------------------------------------------------------------|
| `scraperId`  | `string`       | Yes      | —       | ID of the manual scraper to rerun.                                                                               |
| `url`        | `string`       | Yes      | —       | Target URL for the rerun.                                                                                        |
| `workflow`   | `array<object>`| No       | None    | Allows overriding the saved workflow steps. By default, uses the workflow saved during manual creation.|

#### Request example:
Confidence
70% confidence
Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#### Request example:

```bash
curl -X POST "https://api.app.mrscraper.com/api/v1/scrapers-manual-rerun" \
  -H "accept: application/json" \
  -H "x-api-token: " \
  -H "Content-Type: application/json" \
Confidence
92% confidence
Finding
The manual rerun endpoint supports browser workflow overrides, including 'Inject JavaScript', meaning user-supplied automation logic can be executed by a third-party browser environment against target pages. This materially increases risk because authenticated interactions, DOM extraction, and scripted actions can capture or expose sensitive data beyond simple scraping.

External Transmission

Medium
Category
Data Exfiltration
Content
#### Request example:

```bash
curl -X POST "https://api.app.mrscraper.com/api/v1/scrapers-manual-rerun" \
  -H "accept: application/json" \
  -H "x-api-token: " \
  -H "Content-Type: application/json" \
Confidence
92% confidence
Finding
The manual rerun endpoint supports browser workflow overrides, including 'Inject JavaScript', meaning user-supplied automation logic can be executed by a third-party browser environment against target pages. This materially increases risk because authenticated interactions, DOM extraction, and scripted actions can capture or expose sensitive data beyond simple scraping.

External Transmission

Medium
Category
Data Exfiltration
Content
#### Request example:

```bash
curl -X POST "https://api.app.mrscraper.com/api/v1/scrapers-manual-rerun/bulk" \
  -H "x-api-token: " \
  -H "Content-Type: application/json" \
  -d '{
Confidence
88% confidence
Finding
Bulk manual reruns combine remote workflow execution with multiple target URLs, which increases both exposure and operational impact if the workflow interacts with sensitive pages. A mistaken or overbroad bulk run could send many URLs and associated extracted/authenticated data to the provider in one request.

External Transmission

Medium
Category
Data Exfiltration
Content
#### Request example:

```bash
curl -X POST "https://api.app.mrscraper.com/api/v1/scrapers-manual-rerun/bulk" \
  -H "x-api-token: " \
  -H "Content-Type: application/json" \
  -d '{
Confidence
88% confidence
Finding
Bulk manual reruns combine remote workflow execution with multiple target URLs, which increases both exposure and operational impact if the workflow interacts with sensitive pages. A mistaken or overbroad bulk run could send many URLs and associated extracted/authenticated data to the provider in one request.

External Transmission

Medium
Category
Data Exfiltration
Content
#### Request example:

```bash
curl -X GET "https://api.app.mrscraper.com/api/v1/results?sortField=updatedAt&sortOrder=DESC&pageSize=10&page=1" \
  -H "accept: application/json" \
  -H "x-api-token: <MRSCRAPER_API_TOKEN>"
```
Confidence
82% confidence
Finding
Fetching results from the provider retrieves scraped content and metadata from third-party storage, which implies that collected data persists outside the user's environment. If users scrape sensitive content, this endpoint confirms that such data may be stored and later queried remotely, raising retention and compliance concerns.

External Transmission

Medium
Category
Data Exfiltration
Content
#### Request example:

```bash
curl -X GET "https://api.app.mrscraper.com/api/v1/results/497f6eca-6276-4993-bfeb-53cbbbba6f08" \
  -H "accept: application/json" \
  -H "x-api-token: <MRSCRAPER_API_TOKEN>"
```
Confidence
82% confidence
Finding
Detailed result retrieval exposes that full scrape outputs and related metadata are accessible from the provider after execution, reinforcing that data is stored remotely and may include sensitive page contents. In this skill context, that persistence makes misuse more dangerous than a transient proxy request.

Static analysis

No suspicious patterns detected.