ClawHub
Back to skill

Security audit

Scrapling Yoo

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be legitimate web-scraping guidance, but it gives broad arbitrary web-fetching, browser automation, proxy, and anti-bot capabilities without enough scoping for agent use.

Review before installing in an autonomous agent. Run it in a constrained environment, restrict egress to approved public domains, block loopback/private/link-local/metadata addresses, use anti-bot and proxy features only with authorization, avoid sending credentials through untrusted proxies, and pin dependencies where possible.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/scrapling_scrape.py:48
Finding

Unrestricted URL Fetching Enables Access to Internal Network Resources

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:13
Finding

Unpinned Third-Party Packages and Browser Components Create Supply-Chain Exposure

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill provides extensive network-capable scraping guidance and MCP invocation examples, but it does not declare an explicit tool scope such as allowed tools or permissions. In an agent ecosystem, this weakens governance and makes it easier for the skill to be used for broad outbound network access without clear restriction or user-awareness boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly recommends stealth mode, TLS fingerprint impersonation, proxy rotation, and Cloudflare/Turnstile auto-solving, which are anti-bot evasion techniques. Although some guardrails appear later, they do not directly and prominently warn about legal, policy, account, and abuse risks at the point of use, so the skill materially enables misuse against protected services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file describes tools that perform HTTP requests, browser-based fetching, anti-bot/Cloudflare-bypass requests, and spider crawls, but it does not include any user-facing warning about transmitting URLs/data to remote sites or about crawl activity affecting third-party systems. Under the markdown-specific missing-warning rule, behaviors that can affect privacy or system integrity should be disclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documentation shows direct use of HTTP proxies, including an example with embedded credentials, but does not warn that proxy operators can observe traffic, collect authentication secrets, or log target URLs and session metadata. In a scraping skill, this omission matters because users may copy these patterns into production and expose credentials or sensitive browsing data to untrusted proxy infrastructure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/spider-recipes.md (reported line 72)May include surrounding context.

md
"""Scrape via API endpoints instead of HTML."""
    
    name = "api_products"
    api_base = "https://api.example.com/v1"
    
    def start_requests(self):
        for page in range(1, 100):

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The Image/Media Downloader example writes response bodies to ./downloads via open(path, 'wb'), which affects the user's filesystem, but the markdown provides no warning that running this recipe will create files locally. For markdown skill descriptions, behaviors that modify local data or storage should be disclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The markdown includes a destructive operation using shutil.rmtree("./crawl_checkpoint") to delete a checkpoint directory, but the surrounding text does not warn that this permanently removes saved crawl state. For markdown files, destructive or user-data-affecting behavior should be accompanied by a clear warning about its impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The start_spider example specifies "crawldir": "./crawl_data", which indicates local file creation/storage, but the markdown provides no warning that crawl results will be persisted on disk. For markdown files, data-affecting behavior should be disclosed so users understand local storage implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code performs HTTP/browser-based fetches to user-supplied URLs, which is a network operation covered by the missing-warning rule for code files. Although the module docstring explains usage, it does not disclose that running the script will make outbound requests to the specified targets or potentially transmit system/network metadata.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.