Security audit

Real Estate Spider

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real-estate scraper that openly includes anti-bot and CAPTCHA-bypass workflows, session reuse, and external CAPTCHA-solving examples, so it needs careful review before installation.

Install only if you have permission to collect data from the target sites and are comfortable with automation that may bypass anti-bot controls. Avoid using the CAPTCHA-solving example unless you fully control the image path and provider, do not save authenticated browser sessions unless necessary, and keep generated session files, screenshots, PDFs, and scraped data out of shared folders or source control.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

Location: docs/captcha_strategies.md:110
Finding: Unrestricted Local File Upload to an Unspecified CAPTCHA Service
Content: View full analysis
Remediation: View remediation
MAX_SIZE: raise ValueError("CAPTCHA image is too large") with Image.open(candidate) as image: image.verify() with candidate.open("rb") as image_file: response = requests.post( endpoint, files={"image": (candidate.name, image_file, "image/png")}, headers={"Authorization": f"Bearer {api_key}"}, timeout=15, ) response.raise_for_status() return response.json()["solution"] ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/bypass_real_estate.sh:147
Finding: Browser Session State Is Persisted Without Access Controls or Cleanup
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:28
Finding: Third-Party Dependencies Are Installed Without Version or Integrity Pinning
Content: View full analysis
/dev/null; then echo "agent-browser is not installed" echo "Please run first: npm install -g agent-browser" exit 1 fi ``` ### Technical Analysis The dependency instructions do not specify reviewed versions, hashes, lockfiles, or a trusted registry. Consequently, installation resolves mutable package versions at execution time. A future compromised package release, registry account takeover, or incompatible update could introduce code that was not present during this audit. The global npm recommendation increases exposure because it installs a mutable executable into a user-wide or system-wide command path. Depending on local npm configuration, the installation may also require elevated privileges. No evidence shows a currently malicious or typosquatted package name. The risk arises from unsafe supply-chain controls rather than a confirmed malicious dependency. ### Attack Path 1. A user follows the documented installation instructions. 2. `pip` or `npm` queries the configured package registry and resolves the latest matching release. 3. A package release, transitive dependency, publisher account, or registry response has been compromised after the Skill was reviewed. 4. Installation hooks or imported package code execute with the installing user's privileges. 5. The compromised dependency gains access to the crawler's files, browser state, network connection, and any ...[truncated 672 chars]
Remediation: View remediation
``` ]]>

T09 · Insecure Skill Coding Practices

Note

Location: main.py:98
Finding: Shell Invocation of an Unquoted Project Path
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (60)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明将该技能描述为面向多个中国房产中介网站的通用数据爬虫，并强调自动数据提取。实际代码却仅是一个 shell 脚本，用于链家站点的验证码应对和访问准备：检查 agent-browser、设置特定 cookie、设置浏览器头、访问链家页面、模拟用户操作、截图与快照、提示人工完成验证码、保存已验证会话。其主要目的不是通用爬虫，也没有实现房源数据解析、抽取或多平台适配。虽然“包含反爬虫策略”与代码部分吻合，但整体描述显著夸大并偏离了实际行为，因此应判定为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description promises a universal crawler for several Chinese real-estate websites with anti-crawling handling and automatic data extraction. The supplied code is much narrower: it is a test script for Beike only, using agent-browser to mimic a real browser, visit the homepage, capture a screenshot, and inspect page metadata/elements. While setting realistic headers can be considered part of anti-bot behavior, the main behavior shown is browser automation/testing rather than multi-site crawling or automatic extraction. This is a material description-versus-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: 声明描述的是一个面向多个中国房产中介网站的“通用爬虫技能”，重点包括多站点支持、反爬虫策略和自动化数据提取。实际代码仅测试 https://bj.ke.com/ershoufang 这一个贝壳找房页面，且是面向北京二手房页的实验性抓取与解析脚本。虽然它确实属于房产网站爬取相关代码，也包含基础请求头伪装、随机等待和字段提取，但范围和成熟度都明显低于声明：没有安居客、搜房网、链家支持，没有可见的通用框架，也没有较完整的反爬或自动提取实现。因此描述与实际行为存在实质性不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述的是一个“专业”“通用”的中国房产中介网站爬虫技能，重点应是多平台数据抓取、反爬策略和自动数据提取。实际代码只是一个 shell 测试脚本，专门针对链家北京二手房页面进行 agent-browser 可用性与页面访问测试，包含设置请求头、滚动、截图、文本抓取、检查验证码文案、尝试点击筛选和搜索。虽然其中确实涉及反爬相关操作（浏览器指纹、验证码检查）并与房产网站有关，但缺少通用爬虫应有的多站点支持、稳定抓取逻辑、结构化解析与自动提取流程。因此代码与声明存在实质性偏差，属于描述与实际行为不匹配。
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The guidance to use real cookies obtained after manual verification, spoof referers, use proxies, and limit frequency is explicitly tailored to bypass stronger defenses such as CAPTCHA and origin checks. In this skill context, that materially increases the likelihood of evading access controls rather than simply automating legitimate browsing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The document is broadly framed as operational guidance for bypassing CAPTCHA and anti-bot protections, including fingerprint simulation, saved verified sessions, proxy rotation, and navigation strategies to reach protected pages. In a scraping skill, that transforms the skill from data extraction into access-control circumvention guidance.
Content: No source excerpt is available for this finding.

Ssd 2

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The opening sections provide practical, actionable anti-detection steps such as mobile UA selection, device fingerprint setup, and simulated human behavior. These instructions are semantically clear operational evasion guidance even without explicit harmful keywords.
Content: No source excerpt is available for this finding.

Ssd 4

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This workflow normalizes CAPTCHA bypass by instructing users to manually solve once, save the verified session, and reuse it for subsequent automated access. That creates a repeatable mechanism for extending past an access challenge and undermines the protective purpose of the verification step.
Content: No source excerpt is available for this finding.

Ssd 2

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The proxy-rotation and timing-control sections are classic anti-abuse evasion measures designed to avoid rate limits and bot detection. In context, they directly support sustained scraping against protected targets while reducing the chance of detection or blocking.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This section explicitly documents use of a third-party CAPTCHA-solving service to automate challenge completion, which is a direct anti-bot evasion capability rather than ordinary real-estate data extraction. In the context of a scraping skill targeting commercial property sites, this materially enables circumvention of access controls and can facilitate unauthorized collection at scale.
Content: No source excerpt is available for this finding.

Ssd 2

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The CAPTCHA-solving API snippet operationalizes automated challenge bypass with working code structure, making abuse straightforward. This is especially dangerous because it lowers the skill barrier for evading website protections at scale.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The file has shell-execution capability via subprocess, but that capability is not declared in permissions. Undeclared privileged behavior is dangerous in agent environments because reviewers and users cannot accurately assess what the skill is allowed to do, and shell access can be used to run arbitrary local commands or chained scripts.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: This is a true tool-parameter abuse pattern because subprocess is invoked with shell=True, which grants shell parsing and metacharacter handling to the command string. Even if the current string is constant-like, this pattern is risky in agent code because minor future changes or path manipulation can convert it into command injection or unintended command execution.
Content: Scanner excerpt · main.py (reported line 104)May include surrounding context.
python
print(f"执行命令: {command}") import subprocess result = subprocess.run(command, shell=True, capture_output=True, text=True) if result.returncode == 0: print("agent-browser脚本执行成功")

Lp1

High

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The script performs live browser-driven network access to lianjia.com and related pages, but the capability is not declared in permissions. Undeclared network behavior reduces reviewability and can enable unexpected external communication, especially in a skill that also persists session state and cookies.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This script is explicitly designed to evade a site's anti-bot and CAPTCHA protections through cookie seeding, user-agent/header spoofing, behavioral simulation, proxy use, and session reuse. Those measures are access-control evasion tactics that can facilitate unauthorized scraping, reduce detection, and scale abuse against the target platform.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script's labeling and instructions clearly frame the workflow as CAPTCHA bypassing, which indicates deliberate evasion of a website's access controls. In a scraping skill targeting commercial real-estate sites, this materially increases risk because it operationalizes unauthorized collection and concealment techniques rather than ordinary browsing.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Saving browser session state can persist cookies, tokens, and other authentication-related material, which may later be reused to access accounts or bypass fresh authentication. Because the script does this without a specific warning or opt-in, it creates a meaningful risk of credential-related persistence and session theft from the local filesystem.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The script writes crawler output to user-specified JSON/CSV files, but this file-write capability is not declared in the skill permissions. Undeclared write access is dangerous because it expands the skill's effective capabilities, can overwrite local files if misused, and prevents users or hosts from accurately assessing what the skill is allowed to do.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script checks for CAPTCHA-related text and explicitly tells the operator to manually complete the challenge so browsing can continue. CAPTCHA exists as an access-control and abuse-prevention mechanism, so instructing continuation after challenge presentation facilitates circumvention of the site's protections.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README states that the skill saves session state, screenshots, and scraped data, but it does not clearly and prominently warn users about what sensitive artifacts may be persisted to disk or the security/privacy implications. In a crawler that explicitly includes cookie/session management and anti-bot bypass workflows, saved files can contain authentication tokens, browsing state, or regulated/sensitive data that could later be exposed to other tools, users, or processes on the same system.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger conditions are broad enough that the skill may activate for generic scraping requests, including requests to bypass anti-bot protections, without clear user intent boundaries. In an agent setting, over-broad activation increases the chance of the model selecting risky automation that performs policy-sensitive actions against third-party sites.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The examples hard-code Chinese locale behavior through defaults like city='北京' and the 'Accept-Language: zh-CN,zh;q=0.9' header, and the skill description is entirely framed for Chinese sites without opt-in language selection. This is a natural-language locale policy issue because the skill imposes a specific language/locale rather than offering the user a choice or clearly documenting a justified locale constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill recommends sending CAPTCHA images to a third-party solving service without warning that screenshots may contain personal data, account state, or other sensitive page content. This creates a real data exfiltration risk because users may unknowingly transmit protected information off-device to an untrusted external processor.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 97% confidence
Finding: The code performs an external POST of an image file to a third-party CAPTCHA-solving endpoint, which is direct off-device data transmission. Because the uploaded image may contain sensitive or account-linked information and the endpoint is external, this creates a concrete confidentiality risk in the skill context.
Content: Scanner excerpt · SKILL.md (reported line 344)May include surrounding context.
md
def solve_captcha(image_path): # 上传验证码图片到识别服务 response = requests.post( "https://captcha.service.com/api/solve", files={"image": open(image_path, "rb")} )

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The natural-language description and read_when conditions are written only in Chinese and target China-specific websites, but the manifest does not state that the skill is region-specific or offer any language/locale choice. Per the policy, forcing a specific language or locale without opt-in or clear documented justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.