scout-anti-crawl-v3

• Outcome: Review
• Latest audit: Jul 27, 2026 · 2:20 AM UTC
• Version: 3.0.0

Overview

This web-scraping skill is mostly purpose-aligned, but it embeds a third-party API key and can automatically send user-selected URLs to cloud scraping services without a clear opt-in step.

Review before installing. Use this only for public URLs you are comfortable routing through a local proxy and third-party scraping services. The embedded Olostep key should be removed and rotated, and cloud fallbacks should be disabled by default or gated behind explicit user approval before use in sensitive workspaces.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares only Bash in allowed-tools, but the documented behavior clearly includes network access, local file writing, shell execution, and likely environment/credential handling. This mismatch weakens security review and user consent because the real capability surface is broader than the manifest suggests.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The skill is presented as a generic anti-crawl fetcher, but the documented behavior extends to unrelated search/extraction features, cloud scraping with a hardcoded key, and forced proxy use. This description-behavior gap makes the skill materially more dangerous because users may invoke it without understanding that their targets, traffic, and content can be routed through third parties or specialized site handlers.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The documentation exposes and configures a third-party scraping service using a hardcoded API credential. Hardcoded credentials can be abused by anyone with access to the skill, enabling unauthorized use of the account and causing sensitive target URLs and scraped content to be transmitted to an external provider.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The skill introduces a separate WeChat search capability that is outside the stated anti-crawl fetcher scope. Hidden or weakly disclosed feature expansion increases misuse risk and bypasses informed consent, especially when the capability targets a specific external platform and may trigger additional scraping/search behavior.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill embeds a hardcoded third-party scraping API credential and automatically sends user-provided URLs to that cloud service. This creates credential exposure, unauthorized third-party usage, privacy leakage, and unexpected off-host data transfer that is broader and riskier than the advertised local anti-crawl fetcher behavior.

Missing User Warnings

High

• Confidence: 91% confidence
• Finding: The skill documents fallback to cloud scraping services but omits any warning that target URLs, browsing behavior, and possibly page contents will be transmitted to third parties. In this context, that omission is dangerous because the skill is specifically designed to fetch potentially sensitive or access-restricted targets, amplifying privacy, compliance, and data leakage risks.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The examples show saving fetched content to local files but do not warn users that the skill can write arbitrary remote content to disk. This can create confidentiality and integrity issues in agent environments, especially if saved paths overlap with sensitive workspaces or if downstream tools later trust the written data.

Missing User Warnings

High

• Confidence: 100% confidence
• Finding: A live API credential is hardcoded in the source and used for outbound requests without user disclosure. Anyone with access to the skill code can extract and abuse the credential, causing unauthorized billing, account compromise, service abuse, and loss of control over third-party scraping activity.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The cloud fallback path sends user-supplied URLs to an external scraping backend without explicit warning or consent. Even if only the URL is transmitted at this layer, that can reveal sensitive internal targets, research intent, or private resources, and it violates user expectations for a local fetcher unless clearly disclosed.

External Transmission

Medium

• Category: Data Exfiltration

Content

OLOSTEP_API_KEY = "olostep_gGm6Y10wZgQpHKQsmqoaZaU24SHKkfPHMNef"

# API 参考
curl -s -X POST "https://api.olostep.com/v1/scrapes" \
  -H "Authorization: Bearer $OLOSTEP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 95% confidence
• Finding: curl -s -X POST "https://api.olostep.com/v1/scrapes" \ -H "Authorization: Bearer $OLOSTEP_API_KEY" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium

• Category: Data Exfiltration

Content

OLOSTEP_API_KEY = "olostep_gGm6Y10wZgQpHKQsmqoaZaU24SHKkfPHMNef"

# API 参考
curl -s -X POST "https://api.olostep.com/v1/scrapes" \
  -H "Authorization: Bearer $OLOSTEP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 95% confidence
• Finding: https://api.olostep.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

try:
        headers = {"Authorization": f"Bearer {OLOSTEP_API_KEY}", "Content-Type": "application/json"}
        payload = {"url_to_scrape": url, "formats": ["html"], "wait_before_scraping": 3000}
        resp = requests.post(
            "https://api.olostep.com/v1/scrapes",
            json=payload, headers=headers,
            timeout=timeout,

• Confidence: 96% confidence
• Finding: requests.post( "https://

External Transmission

Medium

• Category: Data Exfiltration

Content

try:
        headers = {"Authorization": f"Bearer {OLOSTEP_API_KEY}", "Content-Type": "application/json"}
        payload = {"url_to_scrape": url, "formats": ["html"], "wait_before_scraping": 3000}
        resp = requests.post(
            "https://api.olostep.com/v1/scrapes",
            json=payload, headers=headers,
            timeout=timeout,

• Confidence: 96% confidence
• Finding: requests.post( "https://api.olostep.com/v1/scrapes", json=

External Transmission

Medium

• Category: Data Exfiltration

Content

headers = {"Authorization": f"Bearer {OLOSTEP_API_KEY}", "Content-Type": "application/json"}
        payload = {"url_to_scrape": url, "formats": ["html"], "wait_before_scraping": 3000}
        resp = requests.post(
            "https://api.olostep.com/v1/scrapes",
            json=payload, headers=headers,
            timeout=timeout,
            proxies={"http": "http://127.0.0.1:7890", "https": "http://127.0.0.1:7890"},

• Confidence: 95% confidence
• Finding: https://api.olostep.com/

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scout.py:168

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:108