ClawHub
Back to skill

Security audit

Panscrapling Web Scraper

Security checks for vulnerabilities and agentic risk

Overview

This web-scraping skill is purpose-aligned, but its automatic setup can make persistent system changes and run mutable remote installers without clear user control.

Review before installing. Use this only in a sandbox or disposable environment, and avoid letting it run automatic setup on your main machine. Require manual confirmation for any Homebrew, Python, pip, Playwright, or Patchright installation, and avoid scraping internal, localhost, private-network, or cloud metadata URLs.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/setup.py:132
Finding

Unpinned Remote Homebrew Installer Is Downloaded and Executed

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
scripts/setup.py:198
Finding

Unpinned Dependency Installation Falls Back to a Third-Party Package Mirror

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/fetch.py:201
Finding

Unrestricted URL Fetching Can Access Local and Cloud Metadata Services

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (14)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
97% confidence
Finding

The skill advertises and documents capabilities that invoke shell execution and outbound network access, including automatic installation of Python, Homebrew-managed packages, and browser binaries, but it declares no explicit tool scope or permission boundaries. In an agent environment, this can cause unexpected code execution and remote access without adequate user consent or platform enforcement, increasing the risk of misuse or SSRF-like fetching of arbitrary URLs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrases are very broad and overlap with normal user requests such as 'fetch', 'scrape', and 'get page content', making accidental invocation likely. In this skill, accidental invocation is more dangerous because activation can lead to network access, anti-bot evasion, and automatic installation behavior rather than a harmless local action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description highlights convenience features like automatic Python installation and browser dependency setup but does not provide a clear warning that the skill may install software, invoke package managers, and download executables/browsers. Hidden installation behavior is risky in agent workflows because users may unknowingly authorize system modification and execution of third-party components.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/fetch.py (reported line 51)May include surrounding context.

python
for py in PYTHON_PATHS:
        if os.path.isfile(py):
            try:
                r = subprocess.run([py, "--version"], capture_output=True, text=True, timeout=5)
                m = re.search(r"Python (\d+)\.(\d+)", r.stdout)
                if m and int(m.group(2)) >= 10:
                    PYTHON_PATH = py

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/fetch.py (reported line 81)May include surrounding context.

python
else:
        # 检查 scrapling 是否已安装
        try:
            r = subprocess.run(
                [python_path, "-c", "import scrapling"],
                capture_output=True, timeout=5
            )

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill performs automatic setup by executing another local Python script without requiring explicit informed consent at the moment of execution. In the context of an agent skill, this is especially risky because routine use of the scraper can silently cross the boundary from data fetching into local code execution and package installation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

The script automatically executes a local setup.py via subprocess during normal fetch flow, which is equivalent to running arbitrary Python code from the skill package. Because this skill advertises auto-installation and embedded offline dependencies, a user invoking a scrape action may unknowingly trigger code execution with the user's privileges.

Content

Scanner excerpt · scripts/fetch.py (reported line 95)May include surrounding context.

python
# 运行 setup.py
    if SETUP_SCRIPT.exists():
        print("📦 Running setup script...")
        subprocess.run([sys.executable, str(SETUP_SCRIPT)], check=False)
        
        # 重新检测
        python_path = find_python()

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The file's natural-language descriptions and user-facing messages are written in Chinese, indicating a fixed locale experience, but there is no opt-in, language selection, or justification that this is a region-specific tool. Under the policy, forcing a specific language without user choice is a locale-policy concern.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
94% confidence
Finding

This helper wraps arbitrary subprocess execution and is later used to run package installers, browser installers, and a remote Homebrew bootstrap command. Although the current call sites are mostly hardcoded, the function centralizes privileged command execution for an auto-install skill, which materially increases risk if the skill is triggered in an automated environment because it can modify the host system and execute fetched code.

Content

Scanner excerpt · scripts/setup.py (reported line 45)May include surrounding context.

python
"""运行命令"""
    print(f"🔧 Running: {' '.join(cmd) if isinstance(cmd, list) else cmd}")
    try:
        result = subprocess.run(
            cmd,
            capture_output=capture,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/setup.py (reported line 69)May include surrounding context.

python
if not os.path.isfile(python_path):
        return None
    try:
        r = subprocess.run(
            [python_path, "--version"],
            capture_output=True, text=True, timeout=5
        )

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script automatically installs Homebrew and executes a remote bootstrap script fetched via curl without explicit user approval. In a skill whose purpose is seamless setup, this creates a highly dangerous trust boundary violation: triggering the skill can cause arbitrary third-party code execution and persistent system modification on the user's machine.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The manifest description and trigger wording are presented primarily in Chinese, and the usage section instructs users to speak using Chinese examples without indicating that other languages are supported. This can be read as a language-specific interaction constraint without explicit user opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill omits a clear safety notice that using it sends requests to external websites and may interact with remote anti-bot systems. In context, this matters more because the skill explicitly promotes Cloudflare bypass and dynamic browsing, which can transmit headers, fingerprints, and browsing actions to third-party systems unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file’s user-facing description and multiple comments/docstrings are written in Chinese, with no indication that language is selectable or intentionally limited to a specific region. Under the policy, forcing a specific language without opt-in or justification is a locale/language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.