Divar Api

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:32 AM UTC
• Version: 1.0.0

Overview

This is a documentation-only Divar API skill, but it pushes broad unofficial scraping workflows involving session cookies, seller phone numbers, and account-related endpoints without enough user controls.

Review before installing. Use only for deliberate, lawful Divar search or listing work; avoid copying session cookies into scripts, do not bulk collect seller phone numbers, and do not use account, chat, call-history, analytics, or telemetry endpoints unless explicitly authorized with a clear data-handling plan.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (21)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: divar-api
description: >
  Use this skill whenever the user wants to search, query, or extract data from Divar (divar.ir) —
  Iran's largest classifieds platform. Triggers include: searching rental or sale listings, filtering
  by district/price/size/rooms/amenities, paginating through results, fetching post details, getting
  contact info, building any kind of Divar search tool or scraper, or any question about the Divar API
  structure. Also use when the user pastes a divar.ir URL and wants to replicate or automate that search.
  Always use this skill when Divar, divar.ir, or Iranian real-estate sea

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 88% confidence

Finding

The instruction to 'intercept a real browser request via DevTools' encourages reverse engineering of live authenticated traffic to obtain hidden API parameters. In an agent skill, this can push operators toward unsafe collection of session-bound data or undocumented behavior, and it can facilitate circumvention of normal access boundaries.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

| `real-estate` | `real-estate` | همه ملک |
| `buy-commercial-property` | `buy-commercial-property` | فروش اداری/تجاری |
| `rent-commercial-property` | `rent-commercial-property` | اجاره اداری/تجاری |
| `rent-temporary` | `rent-temporary` | اجاره کوتاه‌مدت |

When in doubt, intercept a real browser request via DevTools to read the actual `category.str.value`.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · divar-api-documentation.md (reported line 137)May include surrounding context.

md

"token": "QaJr0xgc",
        "web_info": {
          "title": "...",
          "district_persian": "شمس‌آباد",
          "city_persian": "تهران"
        }
      }

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · divar-api-documentation.md (reported line 225)May include surrounding context.

md

"token": "QaJr0xgc",
        "web_info": {
          "title": "...",
          "district_persian": "شمس‌آباد",
          "city_persian": "تهران"
        }
      }

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · divar-api-documentation.md (reported line 504)May include surrounding context.

md

"token": "QaJr0xgc",
        "web_info": {
          "title": "...",
          "district_persian": "شمس‌آباد",
          "city_persian": "تهران"
        }
      }

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · divar-api-documentation.md (reported line 505)May include surrounding context.

md

"token": "QaJr0xgc",
        "web_info": {
          "title": "...",
          "district_persian": "شمس‌آباد",
          "city_persian": "تهران"
        }
      }

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 137)May include surrounding context.

md

"token": "QaJr0xgc",
        "web_info": {
          "title": "...",
          "district_persian": "شمس‌آباد",
          "city_persian": "تهران"
        }
      }

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 225)May include surrounding context.

md

"token": "QaJr0xgc",
        "web_info": {
          "title": "...",
          "district_persian": "شمس‌آباد",
          "city_persian": "تهران"
        }
      }

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · divar-api-documentation.md (reported line 137)May include surrounding context.

json { "widget_type": "POST_ROW", "data": { "@type": "type.googleapis.com/widgets.PostRowData", "title": "70 متر / 2 خواب / آسانسور", "action": { "type": "VIEW_POST", "payload": { "@type": "type.googleapis.com/widgets.ViewPostPayload", "token": "QaJr0xgc", "web_info": { "title": "...", "district_persian": "شمس‌آباد", "city_persian": "تهران" } } }, "image_url": "https://s100.divarcdn.com/...", "bottom_description_text": "دقایقی پیش", "middle_description_text": "۸,۵۰۰,۰۰۰,۰۰۰ تومان", "has_divider": true, "image_count": 4 } }

text

---

### Post Detail

#### `GET /v8/posts-v2/web/{token}`
Returns the full detail page for a single post, as a list of sections containing widget arrays.

**URL parameters**:
- `token` — unique post identifier (e.g. `QaJr0xgc`)

**Response**:
```json
{
  "sections": [
    {
      "section_

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/api-reference.md (reported line 137)May include surrounding context.

json { "widget_type": "POST_ROW", "data": { "@type": "type.googleapis.com/widgets.PostRowData", "title": "70 متر / 2 خواب / آسانسور", "action": { "type": "VIEW_POST", "payload": { "@type": "type.googleapis.com/widgets.ViewPostPayload", "token": "QaJr0xgc", "web_info": { "title": "...", "district_persian": "شمس‌آباد", "city_persian": "تهران" } } }, "image_url": "https://s100.divarcdn.com/...", "bottom_description_text": "دقایقی پیش", "middle_description_text": "۸,۵۰۰,۰۰۰,۰۰۰ تومان", "has_divider": true, "image_count": 4 } }

text

---

### Post Detail

#### `GET /v8/posts-v2/web/{token}`
Returns the full detail page for a single post, as a list of sections containing widget arrays.

**URL parameters**:
- `token` — unique post identifier (e.g. `QaJr0xgc`)

**Response**:
```json
{
  "sections": [
    {
      "section_

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 84% confidence

Finding

The note explicitly instructs the reader to intercept real browser traffic via DevTools to discover actual API values. In the context of an agent skill, this encourages reverse-engineering of a private or unofficial API and operationalizes collection methods beyond ordinary public documentation, increasing legal, compliance, and abuse risk.

Content

Scanner excerpt · references/api-reference.md (reported line 551)May include surrounding context.

md

| `real-estate` | `real-estate` | همه انواع ملک (all real estate) |
| `buy-commercial-property` | `buy-commercial-property` | فروش اداری و تجاری (commercial sale) |
| `rent-commercial-property` | `rent-commercial-property` | اجاره اداری و تجاری (commercial rental) |
| `rent-temporary` | `rent-temporary` | اجاره کوتاه‌مدت (short-term rental) |
| `real-estate-services` | `real-estate-services` | پروژه‌های ساخت‌وساز (construction) |

> ⚠️ The URL path segment (`/s/tehran/rent-residential/...`) is **not** the same as the API slug. Always use the API slug column above. When in doubt, intercept a real search via browser DevTools to read the actual `category.str.value` being sent.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 84% confidence

Finding

This continuation of the same note reinforces a workflow of using DevTools interception to obtain API field values from real searches. For a skill intended to automate Divar access, that guidance materially lowers the barrier to unofficial scraping and authenticated request replication.

Content

Scanner excerpt · references/api-reference.md (reported line 552)May include surrounding context.

md

| `buy-commercial-property` | `buy-commercial-property` | فروش اداری و تجاری (commercial sale) |
| `rent-commercial-property` | `rent-commercial-property` | اجاره اداری و تجاری (commercial rental) |
| `rent-temporary` | `rent-temporary` | اجاره کوتاه‌مدت (short-term rental) |
| `real-estate-services` | `real-estate-services` | پروژه‌های ساخت‌وساز (construction) |

> ⚠️ The URL path segment (`/s/tehran/rent-residential/...`) is **not** the same as the API slug. Always use the API slug column above. When in doubt, intercept a real search via browser DevTools to read the actual `category.str.value` being sent.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The documentation instructs users to obtain and use authenticated session cookies to access protected Divar endpoints, but it does not provide explicit guidance on secure handling of those credentials. In a scraping/automation skill context, this can normalize copying browser session cookies into tools or scripts, which increases the risk of account takeover, session leakage, unauthorized access, and unsafe storage or logging of sensitive auth material.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The activation guidance is extremely broad, including 'any question about the Divar API structure' and 'always use this skill when Divar... is mentioned,' which can cause the agent to invoke the skill in contexts where it is unnecessary or user intent is ambiguous. Over-broad routing increases the chance of unintended scraping, privacy-impacting actions, or misuse of site-specific automation without sufficient policy checks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explains how to retrieve seller contact information but provides no privacy, consent, or data-handling constraints, despite the endpoint exposing personal phone numbers. In an agent context, this omission can normalize automated collection or disclosure of personal contact data and increase risk of privacy abuse, harassment, or policy violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation explicitly describes access to seller contact details and authenticated endpoints but provides no warning about privacy sensitivity, consent, or handling restrictions. In an agent context, that omission makes it easier for the skill to be used to collect or reveal phone numbers and account-related data without appropriate user awareness or safeguards.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation expands beyond search/listing extraction into authenticated user-specific endpoints such as saved-search state, unread chat/call counts, and premium seller business data. In an agent skill, this broadens the operational scope from public search to private account and engagement surfaces, increasing the chance that an agent will access or expose user-specific data without clear user intent or authorization boundaries.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Including analytics, telemetry, action-logging, and Sentry endpoints in a search skill is unnecessary to the stated functionality and can normalize collection or transmission of user interaction data. While these are not exploit payloads by themselves, documenting them as part of the skill can encourage unwanted replication of tracking behavior or leakage of usage metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document describes an authenticated contact-info endpoint that returns a seller phone number, plus other user-associated endpoints, without any privacy or data-handling warning. This can enable scraping or misuse of personal/contact data and normalize access to account-linked information without emphasizing consent or legal constraints.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The reference goes beyond search/listing retrieval and documents notification, call-history, chat, premium-user, analytics, and telemetry endpoints. In a skill marketed for Divar search and data extraction, this broadens capabilities into account-associated and behavioral data collection, increasing privacy and misuse risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The analytics and telemetry section documents endpoints that transmit user interaction and error-reporting data without warning that they are behavioral data flows. Including these endpoints in a scraping/search skill can facilitate covert tracking replication or exfiltration of usage metadata.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.