ClawHub
Back to skill

Security audit

Scrapling MCP

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed web-scraping helper; its network, browser, anti-bot, proxy, and local-output examples fit that purpose, though users should apply clear authorization and isolation practices.

Install this only in a virtual environment or container, use it only on sites you are authorized to scrape, avoid paywalls or private data, and review any examples that download files or delete checkpoint directories before running them.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:17
Finding

Unpinned Scrapling and Playwright Dependency Installation in Primary Setup Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:17-21
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
pip install scrapling[mcp]
# Or for full features:
pip install scrapling[mcp,playwright]
python -m playwright install chromium

Technical Analysis

The installation instructions retrieve the latest available Scrapling package, its transitive dependencies, and Playwright browser components without version constraints, a lockfile, cryptographic hashes, or documented artifact verification.

Because Python packages may execute installation or runtime code with the invoking user's privileges, an upstream package compromise, dependency confusion event, or malicious future release could introduce code not present during this audit. Unpinned versions also make installations unreproducible and allow behavior to change after the Skill has been reviewed.

No evidence indicates that the currently named Scrapling package is malicious. The risk arises from trusting mutable upstream artifacts without pinning or integrity controls.

Attack Path

  1. An attacker compromises a relevant package publisher, distribution account, package index, or transitive dependency.
  2. The attacker publishes a malicious version that satisfies the unrestricted installation request.
  3. A user follows the Skill instructions and runs pip install scrapling[mcp] or pip install scrapling[mcp,playwright].
  4. Pip resolves and installs the attacker-controlled release or dependency.
  5. Malicious installation or runtime code executes in the user's Python environment.
  6. The Playwright installation command may additionally retrieve executable browser artifacts selected by the installed Playwright package.

Impact Assessment

Exploitation could provide code execution with the privileges of the user performing the installation. Depending on that user's permissions, th ...[truncated 418 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin Scrapling, Playwright, and all transitive dependencies to reviewed versions.
  2. Provide a lockfile or hash-locked requirements file generated from a controlled build process.
  3. Install with hash verification, for example using pip install --require-hashes -r requirements.txt.
  4. Document and enforce an approved package index rather than implicitly trusting arbitrary configured indexes.
  5. Verify Playwright browser artifacts using vendor-supported integrity controls and pin the Playwright version that selects those artifacts.
  6. Recommend installation in an isolated virtual environment or container under a non-privileged account.
  7. Establish a dependency update process that includes security review and automated vulnerability scanning before changing pinned versions.

T08 · Insecure Dependencies

Warning
Location
references/mcp-setup.md:5
Finding

Unpinned Scrapling and Browser Components in MCP Setup Documentation

Content
View full analysis

Vulnerability Details

File Location: references/mcp-setup.md:5-11
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
# Base MCP support
pip install scrapling[mcp]

# With browser automation
pip install scrapling[mcp,playwright]
python -m playwright install chromium

Technical Analysis

The MCP setup documentation instructs users to install unrestricted versions of Scrapling, its optional MCP and Playwright dependencies, and a Chromium browser artifact. There is no version pin, dependency lockfile, package hash, trusted-index restriction, or browser artifact verification procedure.

These mutable dependencies can differ from those reviewed when the Skill was published. If an upstream package, publisher account, dependency, or configured package source is compromised, the installation can introduce attacker-controlled executable code.

This finding concerns supply-chain hardening. The audit did not identify evidence that the documented package name or current package content is malicious.

Attack Path

  1. An attacker gains control of an upstream release channel, dependency, publisher account, or package source used by the victim.
  2. The attacker publishes a malicious package version or dependency release.
  3. A user follows references/mcp-setup.md and runs the unpinned installation command.
  4. Pip selects the malicious version because no reviewed version or hash is required.
  5. Attacker-controlled code executes during installation, import, MCP server startup, or later scraping operations.
  6. If browser automation is installed, the resulting environment also retrieves and executes browser components chosen by the mutable Playwright installation.

Impact Assessment

Successful exploitation could execute code with the MCP installation or server user's permissions. The attacker could access files and secrets available to that ...[truncated 390 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace unrestricted installation commands with reviewed, exact version pins.
  2. Publish a complete lockfile containing hashes for Scrapling and every transitive dependency.
  3. Require hash validation during installation and use a trusted, explicitly configured package repository.
  4. Pin the Playwright release and document how Chromium artifacts are authenticated or verified.
  5. Run the MCP server in a dedicated virtual environment, container, or sandbox under a least-privileged account.
  6. Limit the MCP process's filesystem and secret access to what scraping tasks require.
  7. Scan dependency updates and browser artifacts before updating the documented pins.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill clearly provides operational guidance for network-capable scraping, browser automation, proxy rotation, and anti-bot bypass via an MCP server, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch can cause an agent or reviewer to underestimate the skill's execution capabilities, increasing the chance of ungoverned external requests or use of sensitive network actions in broader workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation explicitly promotes a stealth fetch mode with 'Cloudflare bypass' and shows how to enable it, but provides no warning about authorization, terms-of-service, or legal/policy constraints. In a scraping-focused skill, this meaningfully lowers the barrier to evading site protections and can facilitate unauthorized access or abusive collection against protected targets.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/spider-recipes.md (reported line 72)May include surrounding context.

md
"""Scrape via API endpoints instead of HTML."""
    
    name = "api_products"
    api_base = "https://api.example.com/v1"
    
    def start_requests(self):
        for page in range(1, 100):

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The media downloader recipe goes beyond passive scraping guidance and demonstrates fetching remote content and writing it directly to the local filesystem. In a skill intended for extraction and crawling guidance, this expands capability into local side effects and can lead users or downstream agents to persist untrusted remote data without validation, path controls, or safety warnings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This recipe writes downloaded media from remote URLs to local storage but provides no warning that the content is untrusted or that disk writes will occur. That omission increases the chance that an agent or user will perform filesystem-modifying actions unexpectedly, including storing malicious or unwanted content locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The example shows destructive directory deletion as part of a normal reset workflow without any warning or guardrails. In agent-facing documentation, omission of a warning is risky because destructive snippets are likely to be reused verbatim and may be executed against unintended paths.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The pause/resume example includes unconditional recursive deletion of a local directory via shutil.rmtree. Even though it is framed as a reset step, documentation that normalizes destructive deletion without safeguards can cause accidental data loss if copied, adapted, or pointed at the wrong path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This code performs outbound HTTP/browser-based fetching to arbitrary URLs via FetcherSession, DynamicSession, and StealthySession, including stealth and Cloudflare-solving modes. Although the module docstring shows example usage, the runtime code provides no confirmation prompt or user-facing notice when transmitting requests to remote sites.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This code performs HTTP/browser-based fetches to user-supplied URLs via Scrapling fetchers, which is a network operation covered by the missing-warning rule for code files. While the script's purpose implies fetching, there is no explicit disclosure in code comments, prompts, or logs that running it will make outbound requests to the provided targets.

Content

No source excerpt is available for this finding.