Crawlee Web Scraper

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:50 PM UTC
• Version: 1.0.0

Overview

This is a disclosed web scraper, but it is explicitly aimed at bypassing bot detection and bulk-fetching arbitrary URLs without clear safety limits.

Install only if you need a scraper in an isolated, least-privileged environment and will use it only on sites you are authorized to access. Avoid feeding it untrusted URL lists, especially in environments with access to internal services or cloud metadata, and prefer pinned dependencies plus outbound network restrictions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/crawlee_http.py:33

Finding

Unrestricted URL Fetching Enables Server-Side Request Forgery

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:54

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill description claims bot-detection evasion, automatic fallback behavior, and resilient scraping features that the analyzed implementation apparently does not provide. This mismatch can mislead users or downstream agents into relying on security-sensitive behavior that is absent, causing unsafe assumptions, policy bypass attempts, or unintended interaction with protected sites.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file header explicitly markets the tool for 'bot-detection evasion' and use when sites are blocking requests, which encourages bypassing anti-abuse controls rather than operating within permitted access patterns. In the context of an agent skill, this is dangerous because it operationalizes evasion behavior and can facilitate unauthorized scraping, ToS violations, account/IP blocking, or broader abuse of protected web resources.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill exposes capabilities implying file read/write, network access, and shell execution, but the manifest does not declare any tool scope or permission boundaries. In an agent environment, this increases the chance of over-privileged execution and makes it harder to review or constrain what the skill may do before use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly markets bot-detection evasion and bulk scraping but does not warn about legal, policy, or operational risks to external systems. In this context, omission of those warnings makes misuse more likely, especially because the skill is positioned as a drop-in workaround when ordinary fetching is blocked.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code performs HTTP requests to user-supplied URLs and retrieves remote content, but the only messaging describes it as a resilient scraper and bot-detection evasion tool. There is no explicit warning in comments, docstrings, or runtime prompts about contacting external systems and fetching potentially sensitive or policy-restricted content.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/crawlee_http.py (reported line 62)May include surrounding context.

python

def _crawlee_fetch(url):
    """Run crawlee_fetch.py as a subprocess and return a response-like object."""
    try:
        result = subprocess.run(
            [sys.executable, CRAWLEE_SCRIPT, "--url", url, "--extract-text"],
            capture_output=True,
            text=True,

Static analysis

No suspicious patterns detected.