Web Scraper

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:53 AM UTC
• Version: 1.0.1

Overview

This is a real web-scraping toolkit, but it includes under-scoped guidance for cookies, CAPTCHA solving, proxy rotation, and browser-detection bypasses that users should review carefully before installing.

Install only if you intend to use it for authorized, compliant scraping. Avoid using the cookie-export, login-wall, CAPTCHA-solving, proxy-rotation, and webdriver-bypass guidance unless you have explicit permission and a contained environment with no sensitive credentials. Prefer official APIs and public pages, pin dependencies, and remove Chrome's no-sandbox default before running Selenium against arbitrary sites.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/scrape-with-selenium.py:46

Finding

Unpinned Dependencies and Runtime Browser-Driver Download

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:17-19; scripts/scrape-with-selenium.py:27,46
Vulnerability Type: Supply-chain exposure through unpinned dependencies and runtime executable retrieval
Risk Level: Medium

The installation instructions use unpinned package names:

bash

pip install requests beautifulsoup4 lxml
# For JS-heavy sites:
pip install selenium webdriver-manager

The Selenium scraper imports webdriver-manager, downloads or resolves a browser-driver executable at runtime, and launches it:

python

from webdriver_manager.chrome import ChromeDriverManager
from selenium.webdriver.chrome.service import Service

python

service = Service(ChromeDriverManager().install())
return webdriver.Chrome(service=service, options=opts)

Technical Analysis

The project does not pin dependency versions or verify package hashes. Consequently, the code installed under these package names can change after the Skill has been audited. This exposes installation to compromised releases, dependency-account compromise, malicious package-index configuration, or dependency-resolution changes.

ChromeDriverManager().install() further expands the supply-chain trust boundary by acquiring a native executable outside the reviewed project and subsequently passing it to Selenium for execution. The project does not independently validate the downloaded driver's expected checksum or provenance.

There is no evidence that the current dependencies or driver are malicious. The issue is that the effective executable code is mutable and is not cryptographically tied to a reviewed version.

Attack Path

1. An attacker compromises a dependency release, distribution account, configured package index, or browser-driver distribution path.
2. A user follows the documented unpinned pip install commands or invokes the Selenium script.
3. The package manager resolves a compromised dependency, or ...[truncated 756 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct and transitive Python dependency to a reviewed version in a lock file.
2. Install packages with verified hashes, such as through pip install --require-hashes -r requirements.txt.
3. Use an explicitly trusted package index and disable unintended extra indexes.
4. Replace runtime driver retrieval with a preinstalled, version-pinned ChromeDriver supplied by a trusted system package or controlled artifact repository.
5. Verify the browser driver's cryptographic checksum before execution if downloading it at runtime is unavoidable.
6. Run dependency installation and browser execution as an unprivileged user in an isolated environment without credentials or unnecessary filesystem access.
7. Add automated dependency and provenance scanning to the release process.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/scrape-with-selenium.py:38

Finding

Chrome Sandbox Disabled While Rendering Arbitrary Websites

Content

View full analysis

Vulnerability Details

File Location: scripts/scrape-with-selenium.py:34-47, specifically line 38
Vulnerability Type: Unsafe browser security configuration
Risk Level: Medium

The complete driver-construction segment explicitly disables Chrome's sandbox:

python

def make_driver(headless=True):
    opts = Options()
    if headless:
        opts.add_argument("--headless=new")
    opts.add_argument("--no-sandbox")
    opts.add_argument("--disable-dev-shm-usage")
    opts.add_argument("--window-size=1920,1080")
    opts.add_argument(
        "user-agent=Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 "
        "(KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
    )
    service = Service(ChromeDriverManager().install())
    return webdriver.Chrome(service=service, options=opts)

Technical Analysis

Chrome's process sandbox is a defense-in-depth boundary intended to restrict the capabilities of compromised renderer and browser subprocesses. The scraper accepts an arbitrary URL and renders active, attacker-controlled JavaScript from that location. Passing --no-sandbox weakens isolation precisely where untrusted web content is processed.

Disabling the sandbox does not independently create remote code execution; exploitation still generally requires a compatible browser vulnerability. However, if hostile content exploits such a vulnerability, the absence of the sandbox can reduce the number of security boundaries the attacker must bypass and increase the resulting host impact.

The scraping functionality does not inherently require sandbox removal. The option is commonly used as a compatibility workaround in poorly configured containers, but applying it unconditionally exceeds the minimum privilege and isolation requirements for ordinary scraping.

Attack Path

1. A user or untrusted workflow supplies an attacker-controlled URL to scrape-with-selenium.py.
2. The script starts Ch ...[truncated 941 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove opts.add_argument("--no-sandbox") from the default driver configuration.
2. Run Chrome as a non-root user in an environment where its native sandbox operates correctly.
3. If sandbox disabling is unavoidable, require an explicit command-line opt-in and display a clear security warning.
4. Place the browser in a hardened container or virtual machine with no secrets, a read-only root filesystem, minimal mounted directories, dropped Linux capabilities, and strict resource limits.
5. Restrict outbound access to required public destinations and block loopback, private-network, link-local, and cloud-metadata addresses when URLs can come from untrusted sources.
6. Keep Chrome and ChromeDriver pinned to compatible, security-supported versions and apply security updates promptly.
7. Avoid running the scraper as root or under an account with access to sensitive Agent state.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code is related to the declared domain of web scraping and does implement basic extraction plus structured output to JSON/CSV. However, the declared description materially overstates the implemented capabilities. There is no pagination support, no Selenium usage, no rendering of JavaScript-heavy sites, and no real anti-blocking/user-agent rotation despite those claims in the description and script header. Because the actual code is a basic single-request scraper rather than the broader toolkit described, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description overstates the implementation. The code is limited to one pagination-focused scraper using requests/BeautifulSoup and JSON output. It does support website data extraction, pagination handling, simple rate limiting, and structured JSON output, which partially matches. However, major declared capabilities are absent: there is no Selenium integration, no handling of JavaScript-heavy sites, no CSV export, and no meaningful anti-bot bypass beyond a browser-like User-Agent and sleep delay. Therefore the description does not accurately represent the actual code behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation demonstrates exporting cookies from a browser and reusing authenticated sessions without strong warnings about account takeover, secret leakage, privacy exposure, or authorization boundaries. Session cookies are bearer credentials; exposing or storing them insecurely can let anyone with access impersonate the user and access protected data.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill documents network access and writing outputs to files, but it does not declare any explicit tool scope or permissions. In an agent environment, missing scope boundaries can cause the skill to be invoked with broader capabilities than users or orchestrators expect, increasing the risk of unintended scraping, data exfiltration, or unsafe file writes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The invocation language is broad enough to match many generic scraping requests without requiring checks for authorization, legality, or data sensitivity. In agent systems, overly broad activation criteria increase the chance the skill will be selected for risky tasks such as scraping restricted, personal, or policy-sensitive content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Repeating an overly permissive trigger condition in the overview reinforces unsafe routing of the skill to broad classes of scraping tasks. This is more dangerous in context because the same document also includes anti-blocking and authenticated scraping guidance, which can steer the skill toward higher-risk uses once invoked.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file says never to scrape login-protected content, but then provides concrete instructions for exporting browser cookies and using authenticated sessions to access such pages. That contradiction normalizes credential and session-token handling in a way that can enable unauthorized access, privacy violations, or account compromise if users follow the guidance carelessly or against policy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file aggregates proxy rotation, CAPTCHA-solving, and automation-evasion tactics without any warning about legality, terms-of-service violations, account bans, or misuse boundaries. In a web-scraper skill, presenting these techniques as normal operational guidance lowers friction for abusive scraping and normalizes circumvention behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation explicitly recommends CAPTCHA-solving services and manual solving workflows, which materially assist bypassing access controls intended to distinguish humans from automated scraping. In a scraping-focused skill, this goes beyond ordinary data extraction and enables anti-abuse circumvention that can facilitate unauthorized collection at scale.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/anti-blocking.md (reported line 71)May include surrounding context.

python

# Option 1: 2Captcha service (paid)
# import requests
# response = requests.post('https://2captcha.com/in.php', {
#     'key': 'YOUR_API_KEY',
#     'method': 'base64',
#     'body': image_base64,

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The Selenium CDP snippet modifies navigator properties to conceal webdriver use and spoof browser fingerprints, directly helping users evade bot-detection mechanisms. That is a stealth/anti-detection capability not necessary for basic scraping and increases the risk of abuse against sites that intentionally block automation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.