Security audit

scout-anti-crawl-v3

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real anti-crawl web-scraping tool, but it automatically sends user URLs and queries through proxies and third-party cloud services and includes an embedded API credential.

Install only if you are comfortable with target URLs, search terms, and potentially fetched page content being handled by third-party scraping/search services and a local proxy. Avoid using it on private, signed, token-bearing, internal, or regulated URLs unless the cloud fallbacks are disabled or explicitly controlled, and rotate/remove the embedded Olostep credential before use.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

Location: scout.py:172
Finding: Automatic Disclosure of Complete Target URLs to a Third-Party Cloud Service
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scout.py:168
Finding: Hard-Coded Olostep Bearer Credential in Source Code and Documentation
Content: View full analysis
Optional[str]: """Olostep residential proxy cloud browser: bypass WAF/CloudFront protections""" import requests OLOSTEP_API_KEY = "olostep_gGm6Y10wZgQpHKQsmqoaZaU24SHKkfPHMNef" ``` The credential is then used as a bearer token: ```python headers = {"Authorization": f"Bearer {OLOSTEP_API_KEY}", "Content-Type": "application/json"} ``` `SKILL.md` also publishes the same credential: ```python # Already built into fetch_olostep() in scout.py OLOSTEP_API_KEY = "olostep_gGm6Y10wZgQpHKQsmqoaZaU24SHKkfPHMNef" ``` ### Technical Analysis Bearer tokens must be treated as secrets because possession is normally sufficient to authenticate requests. Embedding a live-looking token in distributed source code makes it available to every person or process that can read the Skill package. Repeating it in documentation increases its exposure. No code-level access boundary protects the token. An attacker does not need to invoke the Skill or compromise the host; they can copy the value and use it independently against the documented Olostep API. The reviewed implementation sends the token to the intended HTTPS Olostep endpoint. There is no evidence that it deliberately sends the token to another domain. The vulnerability is the public and reusable storage of the credential, not evidence of credential-stealing malware. ### Attack Path 1. An attacker obtains the Skill package, reads the repository, or views the included documentation. 2. The attacker extracts the plaintext `OLOSTEP_API_KEY`. 3. The attacker constructs requests to the documented Olostep API using: `Authorization: Bearer `. 4. Requests are processed under the credential owner's account a ...[truncated 1034 chars]
Remediation: View remediation
"`. 7. Apply provider-side restrictions, including narrow API scopes, quotas, expiration, and alerting, if supported. 8. Add secret-scanning checks to development and release pipelines. 9. Ensure logs and exception messages never print authorization headers or token values. 10. Establish periodic credential rotation and incident-response procedures for future exposures. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented purpose is a generic anti-crawl scraping helper, but the skill also advertises undeclared capabilities and riskier behaviors: third-party cloud scraping, WeChat search, proxy use, and embedded credentials. This mismatch undermines informed consent and makes it easier for an agent or user to trigger network egress, credential use, and platform-specific collection that they did not reasonably expect from the description.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill documentation contains a live-looking third-party API key in plaintext. Exposed credentials can be abused by anyone who can read the skill, leading to unauthorized API usage, billing impact, account takeover risk for that service context, and attribution of abusive scraping activity to the key owner.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 98% confidence
Finding: The skill performs extensive outbound network activity across multiple fetchers, cloud APIs, proxies, and browser automation while lacking declared network permission coverage. Hidden network capability is especially risky here because the tool is explicitly designed to bypass anti-bot protections and transmit user-supplied URLs and queries to third parties.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 98% confidence
Finding: The skill performs extensive outbound network activity across multiple fetchers, cloud APIs, proxies, and browser automation while lacking declared network permission coverage. Hidden network capability is especially risky here because the tool is explicitly designed to bypass anti-bot protections and transmit user-supplied URLs and queries to third parties.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 98% confidence
Finding: The skill performs extensive outbound network activity across multiple fetchers, cloud APIs, proxies, and browser automation while lacking declared network permission coverage. Hidden network capability is especially risky here because the tool is explicitly designed to bypass anti-bot protections and transmit user-supplied URLs and queries to third parties.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code embeds a live third-party API credential directly in source and uses it to send scraping requests to Olostep. Hard-coded secrets are dangerous because they can be extracted, abused by anyone with code access, generate unauthorized charges, and expose user-requested URLs and scraped content to an external provider.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This code silently uses a hard-coded credential to transmit user-supplied URLs to a third-party scraping service without any user-facing disclosure or consent flow. In this skill’s context, that is more dangerous because the anti-crawl design encourages use on sensitive or access-restricted targets, increasing privacy, compliance, and data-handling risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill omits a clear warning that URLs and page contents may be sent to a third-party cloud scraping service. In this context, users may supply sensitive or internal targets, and undisclosed transmission to an external provider creates privacy, confidentiality, and compliance risks.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The presence of the Olostep API endpoint confirms that this skill is designed to transmit data to an external service. In a scraping skill focused on bypassing anti-bot protections, such transmission is more dangerous because users may route sensitive or legally risky targets through a cloud provider without realizing it.
Content: Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.
md
OLOSTEP_API_KEY = "olostep_gGm6Y10wZgQpHKQsmqoaZaU24SHKkfPHMNef" # API 参考 curl -s -X POST "https://api.olostep.com/v1/scrapes" \ -H "Authorization: Bearer $OLOSTEP_API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The presence of the Olostep API endpoint confirms that this skill is designed to transmit data to an external service. In a scraping skill focused on bypassing anti-bot protections, such transmission is more dangerous because users may route sensitive or legally risky targets through a cloud provider without realizing it.
Content: Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.
md
OLOSTEP_API_KEY = "olostep_gGm6Y10wZgQpHKQsmqoaZaU24SHKkfPHMNef" # API 参考 curl -s -X POST "https://api.olostep.com/v1/scrapes" \ -H "Authorization: Bearer $OLOSTEP_API_KEY" \ -H "Content-Type: application/json" \ -d '{

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The Firecrawl section similarly fails to warn that user-provided targets or extracted content may be handled by an external cloud service. Because this is an agent skill intended to automate scraping, the lack of disclosure increases the chance of accidental exfiltration of sensitive destinations or data to a third party.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scout.py (reported line 116)May include surrounding context.
python
try: # 用 --dump original 获取原始 HTML result = subprocess.run( [obscura_bin, "--proxy", "http://127.0.0.1:7890", "fetch", url, "--dump", "original", "--timeout", str(timeout)], capture_output=True, timeout=timeout + 10,

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scout.py (reported line 127)May include surrounding context.
python
return body print(f" Obscura: 返回验证页/登录页，降级...") # 降级：尝试不用 proxy result = subprocess.run( [obscura_bin, "fetch", url, "--dump", "original", "--timeout", str(timeout)], capture_output=True, timeout=timeout + 10, )

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scout.py (reported line 152)May include surrounding context.
python
return None try: result = subprocess.run( [firecrawl_bin, "scrape", url, "--timeout", str(timeout * 1000)], capture_output=True, timeout=timeout + 15, )

External Transmission

Medium

Category: Data Exfiltration
Confidence: 97% confidence
Finding: The outbound POST to Olostep is a real external transmission rather than a false positive, and it occurs automatically as part of the fallback chain. Because the skill is marketed as defeating anti-crawling, users may not realize their targets are being forwarded to a cloud service, magnifying privacy and compliance risks.
Content: Scanner excerpt · scout.py (reported line 173)May include surrounding context.
python
try: headers = {"Authorization": f"Bearer {OLOSTEP_API_KEY}", "Content-Type": "application/json"} payload = {"url_to_scrape": url, "formats": ["html"], "wait_before_scraping": 3000} resp = requests.post( "https://api.olostep.com/v1/scrapes", json=payload, headers=headers, timeout=timeout,

External Transmission

Medium

Category: Data Exfiltration
Confidence: 97% confidence
Finding: The outbound POST to Olostep is a real external transmission rather than a false positive, and it occurs automatically as part of the fallback chain. Because the skill is marketed as defeating anti-crawling, users may not realize their targets are being forwarded to a cloud service, magnifying privacy and compliance risks.
Content: Scanner excerpt · scout.py (reported line 173)May include surrounding context.
python
try: headers = {"Authorization": f"Bearer {OLOSTEP_API_KEY}", "Content-Type": "application/json"} payload = {"url_to_scrape": url, "formats": ["html"], "wait_before_scraping": 3000} resp = requests.post( "https://api.olostep.com/v1/scrapes", json=payload, headers=headers, timeout=timeout,

External Transmission

Medium

Category: Data Exfiltration
Confidence: 97% confidence
Finding: The hardcoded Olostep endpoint confirms remote service dependence and off-box transfer of scraping requests. This is dangerous in an agent skill because it creates hidden third-party processing of user activity and potentially scraped content, contrary to least surprise and least disclosure principles.
Content: Scanner excerpt · scout.py (reported line 174)May include surrounding context.
python
headers = {"Authorization": f"Bearer {OLOSTEP_API_KEY}", "Content-Type": "application/json"} payload = {"url_to_scrape": url, "formats": ["html"], "wait_before_scraping": 3000} resp = requests.post( "https://api.olostep.com/v1/scrapes", json=payload, headers=headers, timeout=timeout, proxies={"http": "http://127.0.0.1:7890", "https": "http://127.0.0.1:7890"},

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The implemented WeChat/Sogou keyword search materially expands behavior beyond the advertised single-command anti-crawl page fetcher. Scope drift is risky in an agent skill because users and policy engines may approve the skill for one narrow purpose while it also performs unrelated browsing and search automation against external services.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Search keywords are submitted to an external search site through automated browser activity and a configured proxy, but the skill provides no explicit warning that user input will be transmitted off-host. This can leak research intent, sensitive terms, or investigative topics, especially because the proxy and browser automation obscure where the data ultimately flows.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The description claims the skill can handle '99% of websites' with 'one command' and automatic fallback across six layers, but it provides no trigger constraints, scope limits, or usage boundaries. In a web-scraping skill focused on anti-crawl bypass, this kind of broad promise can cause over-invocation and normalize use against protected targets, increasing the chance of misuse and unintended policy or legal violations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The description is entirely in Chinese without documenting that the skill is Chinese-language by design or whether multilingual use is supported. This can cause operator misunderstanding of the skill's purpose and limitations; in a scraping and anti-crawl context, reduced transparency makes it easier for users to invoke the skill without fully understanding escalation behavior or compliance implications.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The module docstring and user-facing descriptions are written in Chinese, which imposes a language/locale assumption on users. There is no indication that the skill supports multiple languages or that Chinese-only behavior is an intentional, documented regional constraint.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scout.py:168

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:108