Security audit

Crawl4AI Web Scraper

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but its crawler script can send an optional API key and requested URLs over plaintext HTTP to any configured Crawl4AI host, which needs review before use.

Install only if you control the Crawl4AI endpoint. Prefer localhost without a shared secret, or require code changes before using CRAWL4AI_KEY with any remote service. Treat returned page content as untrusted data, not as instructions for the agent to follow.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/crawl4ai.js:10
Finding: API credentials and crawl targets transmitted over forced plaintext HTTP
Content: View full analysis
{ const body = JSON.stringify({ urls: Array.isArray(urls) ? urls : [urls] }); const headers = { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) }; if (CRAWL4AI_KEY) { headers['Authorization'] = `Bearer ${CRAWL4AI_KEY}`; } const req = http.request({ hostname, port, path: basePath + '/crawl', method: 'POST', headers }, (res) => { ``` ### Technical Analysis The implementation parses `CRAWL4AI_URL` but does not preserve or validate its protocol. Every request is created with Node.js's `http` module, including when the configured URL uses an `https://` scheme. When `CRAWL4AI_KEY` is set, it is placed in an `Authorization: Bearer` header. For any reachable plaintext HTTP endpoint, that credential and the request body containing the target URLs are transmitted without transport encryption. Although the Skill documentation describes a local Crawl4AI instance, the implementation does not restrict the configured hostname to loopback addresses or trusted hosts. Using an HTTPS URL may cause a connection failure whe ...[truncated 1659 chars]
Remediation: View remediation

other

Warning

Location: scripts/crawl4ai.js:95
Finding: Untrusted scraped webpage content is emitted without an explicit trust boundary
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill declares access to environment variables via requiresEnv but does not define an explicit tool scope such as permissions or allowed-tools. That makes the skill's operational boundaries unclear, which can enable over-broad execution contexts or accidental exposure of sensitive configuration such as service URLs or API keys if the hosting agent grants more access than intended.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script sends user-supplied URLs, and optionally a bearer token, to whatever endpoint is configured in CRAWL4AI_URL without any trust validation or explicit disclosure. In a skill ecosystem where users may assume a local-only scraper, this can quietly exfiltrate browsing targets and credentials to a remote service if the environment is misconfigured or maliciously set.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The stated purpose is a local web-scraping helper, where network access to the local Crawl4AI service is expected. However, loading a bearer token from environment variables introduces credential-handling capability that is not mentioned or clearly justified by the manifest's narrow description of a local instance fetcher.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/crawl4ai.js:12