Ghost Closer Web Scraper

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:33 AM UTC
• Version: 1.0.0

Overview

This scraper does what it claims broadly, but it asks to reuse a real Chrome session and load a user-specific .env file, which creates unnecessary access to browser sessions and possible secrets.

Review before installing. Run this only in an isolated browser profile with no personal logins, remove the hard-coded .env loading, and avoid using it on sensitive networks unless website URLs and redirects are validated. Confirm you are allowed to scrape the target services and handle collected business/profile data appropriately.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scraper.py:17

Finding

Unnecessary Loading of Secrets from a User-Specific Environment File

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scraper.py:41

Finding

Reuse of an Existing Authenticated Chrome Context

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scraper.py:303

Finding

Unvalidated Website Navigation Permits SSRF-Style Access to Internal Resources

Content

View full analysis

list | None: """Try to scrape services or menu from the business website.""" if not website_url: return None page = await self._new_page() try: if not await self._safe_goto(page, website_url): return None ``` The URL passed to this method originates from scraped Google Maps content: ```python website = None if result["google_maps"] and result["google_maps"].get("website"): website = result["google_maps"]["website"] if website: print(f"Scraping services from {website}...", file=sys.stderr) result["services_or_menu"] = await self.scrape_services(website) ``` ### Technical Analysis The website URL obtained from a third-party business listing is passed directly to Playwright navigation. The implementation does not validate: - The URL scheme. - Embedded credentials. - The destination hostname or port. - Resolved IPv4 or IPv6 addresses. - Loopback, private, link-local, or metadata-service address ranges. - Redirect destinations. - DNS rebinding between validation and connection. The browser runs on the user's machine and therefore has access to network destinations that may not be publicly reachable. After navigation, the scraper evaluates the loaded DOM and extracts price-like text or service/menu content. This creates an SSRF-style primitive that can both reach internal resources and return selected text through `services_or_menu`. The later click on menu or services links can also navigate to another destination without validating the resulting URL. ### Attack Path 1. An attacker controls or compromises the website field associated with a business listing. 2. The website field points directly to an internal endpoint, loopback ...[truncated 1196 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Playwright Installation Creates a Mutable Supply-Chain Dependency

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Connecting to an already running Chrome instance over CDP gives this skill access to the broader browser session rather than an isolated scraper context. If the user's Chrome contains authenticated tabs, cookies, or internal pages, the scraper could access or manipulate unrelated data well beyond Google Maps, Facebook, and Instagram scraping.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The hard-coded .env access is a form of credential access because it reads a file conventionally used to store secrets from a specific local workspace. In this skill's context, there is no justified need to access local credentials to scrape public business information, so the behavior is disproportionate and dangerous.

Content

Scanner excerpt · scraper.py (reported line 20)May include surrounding context.

python

from dotenv import load_dotenv

# Load env
load_dotenv(Path("/Users/edwin/.openclaw/workspace/dreams-arts/.env"))

try:
    from playwright.async_api import async_playwright, TimeoutError as PWTimeout

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises executable behavior that uses environment access and live network scraping, but it declares no explicit tool scope or permission boundaries. That makes the agent's effective capabilities ambiguous and can lead to overbroad execution, unintended secret exposure from the referenced .env workflow, or network activity without clear authorization controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill is designed to collect structured data from Google Maps, Facebook, and Instagram for lead generation, but it provides no warning about privacy, downstream data use, or platform terms/compliance implications. In this context, omission of those disclosures increases the risk that an agent will collect and process third-party profile data in ways the user did not fully understand or authorize.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instructions explicitly direct the agent to run a Bash command that triggers live scraping against external services, yet they do not disclose that network activity will occur. This is dangerous because agents or users may unknowingly initiate automated interactions with third-party platforms, creating consent, abuse, and operational risk in addition to possible account or IP blocking.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Loading a local .env file can import API keys, tokens, and other secrets from the operator's machine without any relation to the requested scrape. In the context of an agent skill, undeclared access to local sensitive configuration materially increases risk because the skill executes with host privileges and the imported secrets may become available to other components or future code changes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code loads a hard-coded local .env file from a specific user workspace path, which can import secrets unrelated to the scraper's stated purpose. Even if the script does not directly read those variables later, pulling sensitive environment data into process scope is unnecessary privilege expansion and can expose credentials to downstream code, logs, or connected browser sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code sends user-supplied business and location data to Google Maps, Facebook, Google Search, and arbitrary business websites via automated browser navigation. Although there are progress prints, they do not disclose the privacy impact or third-party data transmission, and the file-level docstring also does not warn the user about this behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description claims scraping from Google Maps, Facebook, and Instagram, but the implementation also follows and scrapes the business's own website. This expands collection scope beyond what a caller would reasonably expect and could trigger browsing to arbitrary third-party domains returned by Google Maps.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.