Security audit

Crawl4ai

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent web-scraping helper, but it can fetch arbitrary URLs and save captured content without strong scope limits or warnings.

Install only if you are comfortable with an agent using this skill to browse and save web page contents. Use it on public or authorized URLs, avoid authenticated/internal/private-network pages, set conservative page counts and delays, and review output paths because files may be overwritten or store sensitive page content.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/scrape_single_page.py:23
Finding: Unrestricted URL Fetching Enables Server-Side Request Forgery in the Single-Page Scraper
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/scrape_multiple_pages.py:48
Finding: Unrestricted Batch URL Fetching Enables Repeated Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The declared description suggests a general web scraping framework for crawling and extracting data from websites, including dynamic content handling. The supplied code instead performs extraction from a single local HTML file specified on the command line. It does not implement web crawling, URL discovery, navigation across websites, or broader scraping orchestration. While it does extract structured data from HTML and uses crawl4ai, its actual scope is narrower and materially different: offline/local HTML parsing and export to JSON. Therefore the description does not accurately represent this specific code chunk's primary behavior.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill demonstrates network access and local file read/write capabilities through its documented scraping workflows and referenced scripts, but it does not declare any tool scope or permissions boundaries. This is dangerous because an invoking agent may use broader-than-expected capabilities to fetch remote content, save scraped data locally, or process local files without an explicit trust boundary or user-visible restriction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description does not clearly warn users that using it may send requests to external websites, execute page JavaScript, and capture page contents or screenshots. This is dangerous because users may unknowingly expose internal URLs, session-bearing pages, or sensitive content to a scraping workflow that stores or returns more data than expected.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrases are very broad and match common user requests like extracting data from a URL or parsing HTML, which increases the chance the skill is invoked automatically in situations involving sensitive or untrusted content. That can lead to unintended network requests, scraping of third-party sites, or collection of screenshots and page data without sufficient user awareness or policy checks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The examples normalize broad website scraping and extraction of products, articles, tables, links, screenshots, and structured data without any guidance on authorization, robots/ToS compliance, privacy, or handling of personal or copyrighted content. In an agent skill, this omission can encourage misuse at scale and make it easier for downstream users or agents to collect data from sites in ways that violate policy, contractual restrictions, or privacy expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file includes an example that converts extracted content to a DataFrame and writes it to scraped_data.csv. The surrounding documentation does not warn that using this example will create or overwrite a local file, which is a user-data-affecting operation under the markdown warning criterion.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file includes an example that writes result.clean_html to debug.html, which could store sensitive page contents locally. The surrounding documentation presents this as a debugging step but does not warn users about potential privacy or data-handling implications.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module usage documentation says users can enable extraction via --json-ld, --links, and --images, implying those are accepted command-line options. In the actual parser, those flags do not exist; extraction is enabled by default and only --no-json-ld, --no-links, and --no-images are implemented, so the documentation contradicts runtime behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This code performs a file write to a user-specified path, which can overwrite existing files, but there is no confirmation prompt or prior warning beyond a success message after the fact. For a code-file safety review, file writes should have some visible disclosure unless clearly warned or confirmed.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example labels the command as JSON-LD-only extraction, but --json-ld is not a supported flag and, more importantly, links and images remain enabled by default unless explicitly disabled. This is an intent/documentation contradiction rather than a mere omission because the example explicitly describes narrower behavior than the code performs.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.