Security audit

SpielerPlus Scraper

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed SpielerPlus/TeamPlus scraper that uses provided account credentials to fetch team data, with privacy and dependency-hygiene caveats but no evidence of hidden or malicious behavior.

Install only if you are authorized to access the SpielerPlus/TeamPlus account and team data involved. Treat the credentials and scraped outputs as sensitive, avoid committing .env files, avoid dumping full financial or absence data into shared logs, and consider pinning dependencies or using a reviewed lockfile before running it in shared or production environments.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: examples/example-docker.md:7
Finding: Mutable and Unlocked Third-Party Dependencies Permit Supply-Chain Substitution
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (33)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CLAUDE.md (reported line 7)May include surrounding context.
bash
npm install cp .env.example .env # Edit .env with your credentials npm run teams

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CLAUDE.md (reported line 8)May include surrounding context.
bash
npm install cp .env.example .env # Edit .env with your credentials npm run teams

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · src/cli.js (reported line 63)May include surrounding context.
js
```bash npm install cp .env.example .env # Edit .env with your credentials npm run teams ```

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · src/cli.js (reported line 65)May include surrounding context.
js
```bash npm install cp .env.example .env # Edit .env with your credentials npm run teams ```

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 190)May include surrounding context.
md
### Required Setup 1. **npm Token** (GitLab CI/CD Variable: `NPM_TOKEN`) - https://www.npmjs.com → Profile → Access Tokens → Create Automation Token 2. **ClawHub** (optional, automatic) - Uses `clawdhub` in CI

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.
md
const SpielerPlusScraper = require('./src/index.js');

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Scope Creep

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file calls require('dotenv').config() and reads process.env despite the manifest declaring only network permission. In a constrained agent platform, undeclared local environment access can expose unrelated secrets from the host runtime and expands the trust boundary beyond what users expect from a network-only scraping skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README explicitly promotes extraction of team members, absences, finances, participation statistics, and profile data, all of which may contain personal or financial information, but gives no meaningful privacy, consent, retention, or sharing guidance. In a scraping tool with network access, this omission increases the likelihood of unauthorized collection, overexposure, or mishandling of sensitive team data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README instructs users to place account credentials in a .env file or export them as environment variables without warning about secret hygiene such as excluding .env from version control, avoiding credential reuse, and protecting local/CI environments. Because the skill accesses a real third-party account, weak guidance here can lead to credential leakage and subsequent account compromise.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation instructs users to provide live account credentials and describes access to potentially sensitive team data such as members, absences, finances, roles, and profiles, but it does not warn about privacy, least-privilege use, or secure credential handling. This increases the chance that users expose personal or financial data without understanding the sensitivity or validating how the scraper stores, transmits, or outputs that information.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The Docker example runs npx playwright install chromium without pinning the Playwright package version, which can cause non-reproducible builds and expose users to unexpected upstream changes or a compromised dependency release at build time. In a network-enabled scraping skill that relies on browser automation, this increases supply-chain risk because the container fetches code during build from the public registry.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The example instructs users to pass account credentials via environment variables without any warning about secure handling, shell history exposure, CI/CD logging, or safer alternatives. In the context of a scraper for a team-management platform, these credentials likely grant access to personal and organizational data, so careless handling could lead to account compromise or privacy exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The example retrieves and prints potentially sensitive team data including members, finances, participation, and profile details directly to stdout. In real environments, console output may be captured by logs, CI systems, terminals, or shared shells, causing unintended disclosure of personal or financial information.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This is a manifest file, so vague-trigger review applies. The description says 'Generic SpielerPlus/TeamPlus scraper for team management data,' which is broad and does not define when the skill should or should not be invoked, increasing the risk of matching loosely related requests about team data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: For markdown files and code files, missing-warning findings should cover behaviors affecting privacy or user data; this manifest description indicates scraping team management data, which commonly includes personal, schedule, attendance, or financial information. The package metadata provides no disclosure about handling sensitive data, authentication, or privacy implications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code exposes potentially sensitive organizational data such as team members, absences, finances, participation, roles, and profile details directly to stdout and via JSON output. Although the operations are part of the scraper's purpose, the CLI provides no warning that personal or financial data may be displayed or exported, which is a missing disclosure for safety-sensitive data handling.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a network scraper for the SpielerPlus/TeamPlus platform, but the code also loads a local .env file and reads process environment variables for secrets. Accessing local configuration/secrets is a separate capability from scraping and is not declared in the skill purpose or permissions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code reads login credentials from environment variables and then uses them to authenticate to an external service, but there is no confirmation prompt, user-facing log, or warning to disclose that account credentials will be used for automated access. Because this skill also navigates authenticated pages and extracts team data, users are not clearly informed in-code about the privacy-sensitive nature of the operation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill enumerates and extracts sensitive organizational data including members, absences, finances, participation, roles, and team profile information. In an agent setting, bulk collection of personal and financial team data without scoped consent, minimization, or access controls increases the risk of privacy violations and over-collection well beyond a narrowly tailored scraping function.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This markdown file instructs the user to copy an environment file and edit it with credentials, but it provides no warning about protecting secrets, avoiding commits, or the fact that the skill will use sensitive account data. Because markdown files should disclose behaviors affecting privacy or sensitive data, this is a missing warning.
Content: No source excerpt is available for this finding.

Lp4

Low

Category: MCP Least Privilege
Confidence: 65% confidence
Finding: Declared permissions with no matching code capability may indicate removed functionality or pre-staging for future abuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The code accesses SPIELERPLUS_EMAIL and SPIELERPLUS_PASSWORD, which are sensitive credentials, but provides no user-facing disclosure about credential usage or handling. Comments only note initialization and optional team selection, not that authentication secrets are being consumed.
Content: No source excerpt is available for this finding.