ClawHub
Back to skill

Security audit

scrapling

Security checks for vulnerabilities and agentic risk

Overview

This scraping skill is coherent, but it needs Review because it promotes anti-bot bypass and persistent AI-tool setup without enough scoping, consent, or safety guidance.

Install only if you need a powerful scraping and browser-automation tool and can keep its use within site terms, law, authorization, privacy, and rate-limit requirements. Pin package and Docker versions, prefer project-scoped MCP registration, review commands before allowing an agent to run them, and avoid sending sensitive or access-restricted scraped data through AI/MCP workflows.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
guides/01-installation.md:113
Finding

Unpinned Third-Party Package Execution and Persistent MCP Registration

Content
View full analysis
Remediation
View remediation
" ``` 4. Use a requirements file with cryptographic hashes and install with: ```bash pip install --require-hashes -r requirements.txt ``` 5. If npm is genuinely required, pin an exact reviewed version, retain lockfile integrity metadata, and avoid automatic confirmation: ```bash npx --package "scrapling-mcp@" scrapling-mcp ``` 6. Prefer project-scoped MCP registration over `--scope user` so the server is not automatically exposed to unrelated future projects. 7. Pin Docker images by immutable digest instead of using `latest`: ```bash docker pull d4vinci/scrapling@sha256: ``` 8. Document the expected publishers, package registry URLs, versions, checksums, and verification procedure. 9. Run browser tooling and MCP servers in a restricted environment with minimal filesystem access, sanitized environment variables, and limited outbound network access. 10. Require explicit user approval before downloading executable dependencies or modifying persistent MCP configuration. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (19)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly promotes anti-bot bypass, Cloudflare Turnstile circumvention, browser automation, and large-scale scraping, but provides no guardrails about authorization, legal restrictions, privacy, robots.txt, or service-impact limits. In an AI-agent context, this increases the chance of misuse for unauthorized data extraction or evasive activity because the skill frames bypass features as normal workflow capabilities without any safety boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Marking installation commands as 'AI 可自动执行' encourages unattended execution of commands that install Python packages, browser automation frameworks, browser binaries, and containers. In an AI-agent context, this lowers friction for executing external code and broadens the blast radius of supply-chain compromise or misconfiguration.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

Using docker pull d4vinci/scrapling:latest relies on a mutable tag, so the content fetched can change over time without notice. If the image is updated maliciously or the upstream registry/account is compromised, users may pull and later execute unreviewed code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The docker run -it d4vinci/scrapling:latest python3 example executes a container from a mutable latest tag. Because container execution directly runs code and bundled dependencies, a changed or compromised image could expose users to arbitrary code execution inside the container and potential host interaction depending on runtime settings.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The example docker run --rm d4vinci/scrapling:latest python3 -c ... both executes a mutable container image and runs embedded Python code from it. In an AI-oriented installation guide, this raises the risk of automated execution of unpinned third-party code with little user review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The MCP section does not warn that the command adds or configures an AI-accessible MCP server in the user's Claude environment. That can expand an agent's capabilities and trust surface without clear consent, especially when combined with an unpinned package installation path.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The guide instructs users to run npx -y scrapling-mcp without pinning a package version or integrity reference. That causes execution of whatever package version is current in the registry at install time, creating a supply-chain risk if a malicious or compromised release is published.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The quickstart explicitly demonstrates Cloudflare/anti-bot bypass and protected-site scraping but provides no warning about legality, terms-of-service, privacy obligations, or the risk of unauthorized access behavior. In a beginner-oriented guide, this lowers the barrier to potentially abusive scraping and can lead users to deploy evasion techniques against sites without understanding policy, consent, or compliance implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation explicitly promotes using an MCP server so an AI client can control scraping and consume extracted site data, but it does not warn that scraped content may be transmitted to external AI tooling or logs. This can lead users to unknowingly send sensitive, copyrighted, authenticated, or regulated data from target sites into third-party processing pipelines.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
60% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · guides/03-advanced-usage.md (reported line 224)May include surrounding context.

products = page.css('.product', auto_save=True)

后续运行：从缓存读取，无需网络请求（快速迭代解析逻辑）

page = Fetcher.get('https://example.com', cache=True, dev_mode=True) products = page.css('.product', adaptive=True)

text

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · troubleshooting.md (reported line 69)May include surrounding context.

md
playwright install-deps chromium

# 或手动安装
sudo apt-get install -y libatk1.0-0 libatk-bridge2.0-0 libcups2 \
  libdrm2 libxkbcommon0 libxcomposite1 libxdamage1 libxrandr2 \
  libgbm1 libpango-1.0-0 libcairo2 libasound2

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file provides step-by-step guidance for automatic Cloudflare and anti-bot bypass, including StealthyFetcher, solve_cloudflare=True, and behavior tuning to avoid detection, without any warning about authorization or acceptable use. Given the skill's stated purpose includes anti-scraping bypass and large-scale extraction, this materially enables misuse against protected services and is more dangerous in this context than in a neutral browser-automation document.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The troubleshooting guidance explicitly recommends disabling robots.txt compliance to improve crawling speed without any warning about policy, authorization, or legal implications. In the context of a scraping framework that already emphasizes large-scale crawling and anti-bot evasion, this increases the chance that users will perform unauthorized or abusive collection against site operator preferences.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The natural-language description and instructions are presented only in Chinese, which effectively forces a specific language for users of the skill. There is no indication that the user can opt into another language or that the language restriction is required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The file presents all user-facing instructions in a single language and does not offer an opt-in, alternative language, or justification for a locale-specific audience. Under the language/locale policy, forcing one language without user choice can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

Low
Category
Tool Misuse
Confidence
15% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · guides/01-installation.md (reported line 86)May include surrounding context.

md
docker run -it d4vinci/scrapling:latest python3

# 在容器内直接使用
docker run --rm d4vinci/scrapling:latest python3 -c "
from scrapling.fetchers import StealthyFetcher
page = StealthyFetcher.fetch('https://example.com', headless=True)
print(page.css('title::text').get())

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The auto_save=True example states that element snapshots are stored in a local database but does not warn that page-derived content, selectors, or metadata may persist on disk beyond the current run. This can create unintended local retention of scraped data, including sensitive or proprietary page content, especially for users who assume examples are ephemeral.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file is entirely written in Chinese and does not indicate that other language options are available. Per the policy, forcing a specific language without user opt-in can be a locale/language policy issue unless clearly documented as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.