Scrapling Yoo

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:36 AM UTC
• Version: 1.0.0

Overview

The skill appears to be legitimate web-scraping guidance, but it gives broad arbitrary web-fetching, browser automation, proxy, and anti-bot capabilities without enough scoping for agent use.

Review before installing in an autonomous agent. Run it in a constrained environment, restrict egress to approved public domains, block loopback/private/link-local/metadata addresses, use anti-bot and proxy features only with authorization, avoid sending credentials through untrusted proxies, and pin dependencies where possible.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/scrapling_scrape.py:48
• Finding: Unrestricted URL Fetching Enables Access to Internal Network Resources<![CDATA[ ## Vulnerability Details **File Location**: `scripts/scrapling_scrape.py:48-83` **Additional Locations**: `scripts/scrapling_smoke_test.py:70-120`, `SKILL.md:35-42`, `SKILL.md:76-96`, `references/mcp-setup.md:47-78`, `references/mcp-setup.md:121-136` **Vulnerability Type**: Unrestricted URL fetching / server-side request forgery risk **Risk Level**: Medium ### Vulnerable Code ```python p.add_argument("--url", required=True) p.add_argument("--mode", choices=["fetcher", "dynamic", "stealthy"], default="fetcher") p.add_argument("--css", help="CSS selector (supports ::text and ::attr())") p.add_argument("--xpath", help="XPath selector") p.add_argument("--first", action="store_true", help="Return only the first match") p.add_argument("--headless", action="store_true", help="Headless browser (dynamic/stealthy)") p.add_argument("--solve-cloudflare", action="store_true", help="Attempt to solve Cloudflare (stealthy session)") p.add_argument("--network-idle", action="store_true", help="Wait for network idle (dynamic session)") p.add_argument("--adaptive", action="store_true", help="Use adaptive selectors (if supported)") p.add_argument("--auto-save", action="store_true", help="Auto-save selector fingerprints (if supported)") p.add_argument("--pretty", action="store_true", help="Pretty-print JSON") args = p.parse_args() if not args.css and not args.xpath: _die("Provide --css or --xpath") url = args.url try: # Sessions are more reliable than one-shot fetchers for anything non-trivial. from scrapling.fetchers import FetcherSession, DynamicSession, StealthySession except Exception: _die( "Scrapling is not installed in this Python environment. Try:\n" " python3 -m pip install scrapling\n" "If you need browser-based fetching, you may also need:\n" " python3 -m playwright install chromium" ) if args.mode == "fetcher": with FetcherSession(impersonate="chrome") as session: page = session.get(url, ...[truncated 4286 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Permit only explicitly supported schemes, normally `https` and optionally `http`. 2. Parse URLs using a standards-compliant parser and reject embedded credentials, malformed hosts, ambiguous numeric IP representations, and unexpected ports where appropriate. 3. Resolve the hostname before connecting and reject every resolved address that is: - Loopback. - Private. - Link-local. - Reserved. - Multicast. - Unspecified. 4. Explicitly deny known cloud metadata hostnames and addresses. 5. Apply the same checks to IPv4 and IPv6 addresses. 6. Revalidate every redirect target before following it. 7. Use a network egress proxy or firewall to enforce the policy independently of application-level validation. 8. Prefer a hostname allowlist when the Skill is used autonomously by an agent. 9. Mitigate DNS rebinding by connecting only to validated resolved addresses or by enforcing restrictions at the egress layer. 10. Add strict request timeouts, response-size limits, redirect limits, and crawl budgets. 11. Require explicit user confirmation before accessing non-public or newly encountered domains. 12. Document that URLs obtained from webpages or model output are untrusted input. ]]>

T08 · Insecure Dependencies

Note

• Location: SKILL.md:13
• Finding: Unpinned Third-Party Packages and Browser Components Create Supply-Chain Exposure<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:13-18` **Additional Locations**: `references/mcp-setup.md:3-11`, `scripts/scrapling_scrape.py:64-70` **Vulnerability Type**: Unpinned dependency installation **Risk Level**: Low ### Vulnerable Code ```bash pip install scrapling[mcp] # Or for full features: pip install scrapling[mcp,playwright] python -m playwright install chromium ``` The detailed setup guide repeats the same installation pattern: ```bash # Base MCP support pip install scrapling[mcp] # With browser automation pip install scrapling[mcp,playwright] python -m playwright install chromium ``` The helper script also recommends an unpinned installation: ```python except Exception: _die( "Scrapling is not installed in this Python environment. Try:\n" " python3 -m pip install scrapling\n" "If you need browser-based fetching, you may also need:\n" " python3 -m playwright install chromium" ) ``` ### Technical Analysis The installation instructions do not specify reviewed package versions, lock transitive dependencies, or require artifact hashes. The effective installed code can therefore change over time without any modification to the audited Skill. The Playwright command additionally downloads and installs a Chromium build selected by the installed Playwright version. This expands the trusted computing base beyond the files present in the Skill package. The documented project name and official repository and documentation links are internally consistent. The audit found no evidence of dependency confusion, typo-squatting, an intentionally malicious package, or a suspicious custom package index. The issue is the absence of reproducible and integrity-verified installation controls. ### Attack Path 1. A user follows the Skill's installation instructions. 2. pip resolves the latest versions satisfying the unconstrained package request, including transitive dependencies. 3. A compromised, ...[truncated 1126 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin Scrapling, Playwright, and other direct dependencies to reviewed versions. 2. Supply a lock file or constraints file that also fixes transitive versions. 3. Use hash-verified installation, such as a requirements file containing `--hash` entries and installation with `--require-hashes`. 4. Record the supported Python version and platform-specific dependency set. 5. Install dependencies in a dedicated virtual environment, container, or other least-privileged sandbox. 6. Run dependency vulnerability and provenance checks during release preparation. 7. Review and intentionally update the lock file rather than resolving new versions automatically. 8. Document the expected package index and recommend disabling untrusted extra indexes. 9. Pin the Playwright version so the associated browser build is deterministic, and verify downloaded browser artifacts through the package vendor's supported integrity mechanism. 10. Avoid installing or running the MCP service with administrative privileges. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill provides extensive network-capable scraping guidance and MCP invocation examples, but it does not declare an explicit tool scope such as allowed tools or permissions. In an agent ecosystem, this weakens governance and makes it easier for the skill to be used for broad outbound network access without clear restriction or user-awareness boundaries.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly recommends stealth mode, TLS fingerprint impersonation, proxy rotation, and Cloudflare/Turnstile auto-solving, which are anti-bot evasion techniques. Although some guardrails appear later, they do not directly and prominently warn about legal, policy, account, and abuse risks at the point of use, so the skill materially enables misuse against protected services.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: This markdown file describes tools that perform HTTP requests, browser-based fetching, anti-bot/Cloudflare-bypass requests, and spider crawls, but it does not include any user-facing warning about transmitting URLs/data to remote sites or about crawl activity affecting third-party systems. Under the markdown-specific missing-warning rule, behaviors that can affect privacy or system integrity should be disclosed.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation shows direct use of HTTP proxies, including an example with embedded credentials, but does not warn that proxy operators can observe traffic, collect authentication secrets, or log target URLs and session metadata. In a scraping skill, this omission matters because users may copy these patterns into production and expose credentials or sensitive browsing data to untrusted proxy infrastructure.

External Transmission

Medium

• Category: Data Exfiltration

Content

"""Scrape via API endpoints instead of HTML."""
    
    name = "api_products"
    api_base = "https://api.example.com/v1"
    
    def start_requests(self):
        for page in range(1, 100):

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The Image/Media Downloader example writes response bodies to ./downloads via open(path, 'wb'), which affects the user's filesystem, but the markdown provides no warning that running this recipe will create files locally. For markdown skill descriptions, behaviors that modify local data or storage should be disclosed.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The markdown includes a destructive operation using shutil.rmtree("./crawl_checkpoint") to delete a checkpoint directory, but the surrounding text does not warn that this permanently removes saved crawl state. For markdown files, destructive or user-data-affecting behavior should be accompanied by a clear warning about its impact.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The `start_spider` example specifies `"crawldir": "./crawl_data"`, which indicates local file creation/storage, but the markdown provides no warning that crawl results will be persisted on disk. For markdown files, data-affecting behavior should be disclosed so users understand local storage implications.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: This code performs HTTP/browser-based fetches to user-supplied URLs, which is a network operation covered by the missing-warning rule for code files. Although the module docstring explains usage, it does not disclose that running the script will make outbound requests to the specified targets or potentially transmit system/network metadata.

Static analysis

No suspicious patterns detected.