ClawHub
Back to skill

Security audit

Car Scraper

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed car-data scraper, but it deliberately includes anti-bot evasion and lacks safeguards for sensitive scraped data and unintended network requests.

Review before installing. Use only where you have permission to collect the target data, run it in an isolated environment, restrict outbound network access to the intended domains, avoid exporting VINs or dealer contact details unless legally permitted, and treat all JSON/JSONL/CSV output as untrusted data before importing it into agents or opening it in spreadsheets.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
dasouche_scraper.py:177
Finding

Unrestricted Remote Detail URLs Enable Server-Side Request Forgery

Content
View full analysis

Vulnerability Details

File Location: dasouche_scraper.py:177-187, 324-329; dongchedi_scraper.py:245-255, 426-431; autohome_scraper.py:248-257, 508-513. Identical vulnerable code is present under 万能反爬skill/. Vulnerability Type: Server-Side Request Forgery Risk Level: High

Vulnerable Code

dasouche_scraper.py:

python
def scrape_detail(self, car_id: str, detail_url: str = "") -> Optional[VehicleInfo]:
    if not detail_url:
        detail_url = self.config.detail_url_pattern.format(car_id=car_id)

    if detail_url.startswith("/"):
        detail_url = self.config.base_url + detail_url

    resp = self._request(detail_url, referer=self.config.list_url)
    if not resp:
        return None
python
for idx, item in enumerate(all_list_items):
    car_id = item.get("id", "")
    detail_url = item.get("url", "")
    if not car_id and not detail_url:
        continue

    vehicle = self.scrape_detail(car_id, detail_url)

dongchedi_scraper.py:

python
def scrape_detail(self, car_id: str, detail_url: str = "") -> Optional[VehicleInfo]:
    if not detail_url:
        detail_url = self.config.detail_url_pattern.format(car_id=car_id)
    if detail_url.startswith("/"):
        detail_url = self.config.base_url + detail_url

    resp = self._request(
        detail_url,
        referer="https://www.dongchedi.com/usedcar",
    )
    if not resp:
        return None
python
for idx, item in enumerate(all_list_items):
    car_id = item.get("id", "")
    detail_url = item.get("url", "")
    if not car_id and not detail_url:
        continue

    vehicle = self.scrape_detail(car_id, detail_url)

autohome_scraper.py:

python
def scrape_detail(self, car_id: str, detail_url: str = "") -> Optional[VehicleInfo]:
    if not detail_url:
        detail_url = self.config.detail_url_pattern.format(car_id=car_id)
    if det
...[truncated 2518 chars]
Remediation
View remediation

Remediation Suggestions

  1. Resolve relative links with urllib.parse.urljoin() rather than string concatenation.
  2. Permit only HTTPS URLs on an explicit hostname allowlist:
    • www.souche.com for Souche.
    • www.dongchedi.com for Dongchedi.
    • www.che168.com, che168.com, and explicitly required Autohome hosts for Autohome.
  3. Reject URLs containing user information, fragments where unnecessary, unexpected ports, or non-HTTP schemes.
  4. Resolve the hostname before connecting and reject loopback, private, link-local, multicast, unspecified, and reserved IP addresses for both IPv4 and IPv6.
  5. Disable automatic redirects with allow_redirects=False, or validate every redirect target before following it.
  6. Revalidate the connected destination to reduce DNS rebinding risk.
  7. Construct detail URLs from validated vehicle identifiers where possible instead of trusting upstream absolute URLs.
  8. Add tests covering loopback addresses, private IPv4 ranges, IPv6 loopback, encoded IP representations, malicious redirects, and DNS rebinding scenarios.

T09 · Insecure Skill Coding Practices

Warning
Location
openclaw_export.py:198
Finding

Untrusted Scraped Values Can Trigger Spreadsheet Formula Injection

Content
View full analysis

Vulnerability Details

File Location: openclaw_export.py:198-244; identical code exists at 万能反爬skill/openclaw_export.py:198-244 Vulnerability Type: CSV Formula Injection Risk Level: Medium

Vulnerable Code

python
csv_fields = [
    "source", "source_id", "source_url", "title", "brand", "series",
    "model", "year", "price", "original_price", "mileage", "mileage_km",
    "color", "plate_city", "plate_date", "vin",
    "fuel_type", "engine", "transmission", "drive_type", "body_type",
    "displacement", "seats", "emission_standard",
    "battery_capacity", "range_km",
    "dealer_name", "dealer_city", "dealer_phone",
    "thumbnail", "images_count", "condition_tags", "scraped_at",
]

with open(filepath, "w", encoding="utf-8-sig", newline="") as f:
    writer = csv.DictWriter(f, fieldnames=csv_fields)
    writer.writeheader()

    for v in vehicles:
        row = {
            "source": v.source,
            "source_id": v.source_id,
            "source_url": v.source_url,
            "title": v.title,
            "brand": v.brand,
            "series": v.series,
            "model": v.model,
            "year": v.year,
            "price": v.price,
            "original_price": v.original_price,
            "mileage": v.mileage,
            "mileage_km": v.mileage_km,
            "color": v.color,
            "plate_city": v.plate_city,
            "plate_date": v.plate_date,
            "vin": v.vin,
            "fuel_type": v.fuel_type,
            "engine": v.engine,
            "transmission": v.transmission,
            "drive_type": v.drive_type,
            "body_type": v.body_type,
            "displacement": v.displacement,
            "seats": v.seats,
            "emission_standard": v.emission_standard,
            "battery_capacity": v.battery_capacity,
            "range_km": v.range_km,
            "dealer_name": v.dealer_name,
    
...[truncated 2042 chars]
Remediation
View remediation

Remediation Suggestions

  1. Sanitize every string cell immediately before CSV serialization.
  2. If the first non-whitespace character is =, +, -, or @, prefix the value with a single quote or another spreadsheet-safe marker.
  3. Also account for leading tabs, carriage returns, line feeds, and Unicode whitespace that can precede a formula character.
  4. Apply the protection uniformly to all fields, including URLs, identifiers, phone numbers, tags, and timestamps.
  5. Keep the original unsanitized value only in structured JSON when required, while clearly documenting that it remains untrusted.
  6. Add unit tests for formula prefixes, leading whitespace, embedded line breaks, and common spreadsheet payload patterns.
  7. Warn users that CSV files contain externally sourced data and should be opened with formula evaluation disabled.

T02 · Agent Memory Poisoning

Warning
Location
openclaw_export.py:32
Finding

Untrusted Website Content Is Exported for Agent Ingestion Without Instruction Isolation

Content
View full analysis

Vulnerability Details

File Location: openclaw_export.py:32-140, with remote values populated at dongchedi_scraper.py:363-364 and autohome_scraper.py:357-358; identical code exists under 万能反爬skill/ Vulnerability Type: Persistent Prompt Injection Through Imported Scraped Content Risk Level: Medium

Vulnerable Code

Remote-controlled description and highlight fields are copied into the vehicle model:

python
vehicle.highlights = car.get("highlights", car.get("selling_point", ""))
vehicle.description = car.get("description", car.get("remark", ""))

They are then converted into general OpenClaw document content:

python
if vehicle.highlights:
    content_parts.append(f"\n亮点: {vehicle.highlights}")
if vehicle.description:
    content_parts.append(f"\n描述: {vehicle.description}")

content = "\n".join(content_parts)

doc = {
    "url": vehicle.source_url,
    "title": vehicle.title or f"{vehicle.brand} {vehicle.series} {vehicle.year}",
    "content": content,
    "source": f"car_scraper_{vehicle.source}",
    "timestamp": vehicle.scraped_at or datetime.now().isoformat(),
    "metadata": {
        "source_platform": vehicle.source,
        "source_id": vehicle.source_id,
        "vehicle_type": "used_car",
        "brand": vehicle.brand,
        "series": vehicle.series,
        "model": vehicle.model,
        "year": vehicle.year,
        "price_cny_wan": vehicle.price,
        "original_price_cny_wan": vehicle.original_price,
        "mileage": vehicle.mileage,
        "mileage_km": vehicle.mileage_km,
        "fuel_type": vehicle.fuel_type,
        "transmission": vehicle.transmission,
        "body_type": vehicle.body_type,
        "color": vehicle.color,
        "plate_city": vehicle.plate_city,
        "plate_date": vehicle.plate_date,
        "vin": vehicle.vin,
        "emission_standard": vehicle.emission_standard,
        "images": vehicle.image
...[truncated 2265 chars]
Remediation
View remediation

Remediation Suggestions

  1. Explicitly label all scraped fields as untrusted third-party content.
  2. Preserve structured field boundaries instead of combining external values into a general instruction-like content block.
  3. Wrap imported text in a data-only envelope that tells the consuming Agent never to treat the enclosed content as instructions.
  4. Store provenance metadata, including source hostname, retrieval time, field origin, and trust level.
  5. Require the downstream OpenClaw ingestion pipeline to separate system instructions from retrieved documents and to ignore instructions found in retrieved data.
  6. Consider detecting and quarantining common prompt-injection phrases before persistent indexing, while retaining the original record for manual review.
  7. Restrict tools and sensitive context available during retrieval-assisted processing.
  8. Add adversarial ingestion tests using descriptions that attempt role changes, secret extraction, tool invocation, and memory modification.

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Mutable Unhashed Dependency Ranges Undermine Build Integrity

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1-3 and installation guidance in README.md:32-37; identical files exist under 万能反爬skill/ Vulnerability Type: Unpinned and Unverified Third-Party Dependencies Risk Level: Low

Vulnerable Code

text
requests>=2.31.0
beautifulsoup4>=4.12.0
lxml>=4.9.0

The documented installation procedure is:

bash
pip install -r requirements.txt

Technical Analysis

The requirements specify only minimum versions. There are no exact pins, upper bounds, package hashes, or lockfile. Consequently, two installations performed at different times may resolve to materially different dependency versions.

Package installation can execute build backend or installation logic, and runtime behavior may change in later versions. Although the reviewed package names are established projects and no malicious dependency was identified in the supplied files, the current configuration does not provide reproducible or cryptographically verified dependency resolution.

Attack Path

  1. A user runs the documented pip install -r requirements.txt command.
  2. The package index resolves any version satisfying each minimum constraint.
  3. A future vulnerable, compromised, or behaviorally incompatible release is selected.
  4. Installation or subsequent Skill execution runs the selected dependency code in the user's environment.
  5. The dependency inherits the privileges of the installation or runtime process.

Impact Assessment

If a selected dependency release is compromised, impact could include arbitrary code execution with the privileges of the user performing installation or running the Skill. More commonly, mutable resolution can introduce regressions, parser vulnerabilities, or unexpected network behavior.

No evidence was found that the currently named packages are intentionally malicious; this finding concerns missing supply-chain controls and ...[truncated 22 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin each direct and transitive dependency to a reviewed version.
  2. Generate a hash-locked requirements file using a controlled dependency-management tool.
  3. Install with hash verification enabled, such as pip install --require-hashes.
  4. Perform installation inside an isolated virtual environment or container with minimal privileges.
  5. Use a trusted package index and configure index URLs explicitly where appropriate.
  6. Automate vulnerability and license scanning for every dependency update.
  7. Review and regenerate the lockfile through a controlled update process rather than resolving unrestricted versions during deployment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (55)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The finding indicates the skill claims substantial scraping and anti-bot functionality that is not actually implemented. False or inflated capability claims are dangerous in this context because the skill is already aimed at bypassing anti-scraping controls; any ambiguity makes abuse harder to detect and review.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The finding indicates the skill claims substantial scraping and anti-bot functionality that is not actually implemented. False or inflated capability claims are dangerous in this context because the skill is already aimed at bypassing anti-scraping controls; any ambiguity makes abuse harder to detect and review.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The finding indicates the skill claims substantial scraping and anti-bot functionality that is not actually implemented. False or inflated capability claims are dangerous in this context because the skill is already aimed at bypassing anti-scraping controls; any ambiguity makes abuse harder to detect and review.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The finding indicates the skill claims substantial scraping and anti-bot functionality that is not actually implemented. False or inflated capability claims are dangerous in this context because the skill is already aimed at bypassing anti-scraping controls; any ambiguity makes abuse harder to detect and review.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The finding indicates the skill claims substantial scraping and anti-bot functionality that is not actually implemented. False or inflated capability claims are dangerous in this context because the skill is already aimed at bypassing anti-scraping controls; any ambiguity makes abuse harder to detect and review.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The finding indicates the skill claims substantial scraping and anti-bot functionality that is not actually implemented. False or inflated capability claims are dangerous in this context because the skill is already aimed at bypassing anti-scraping controls; any ambiguity makes abuse harder to detect and review.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The finding indicates the skill claims substantial scraping and anti-bot functionality that is not actually implemented. False or inflated capability claims are dangerous in this context because the skill is already aimed at bypassing anti-scraping controls; any ambiguity makes abuse harder to detect and review.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The finding indicates the skill claims substantial scraping and anti-bot functionality that is not actually implemented. False or inflated capability claims are dangerous in this context because the skill is already aimed at bypassing anti-scraping controls; any ambiguity makes abuse harder to detect and review.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The finding indicates the skill claims substantial scraping and anti-bot functionality that is not actually implemented. False or inflated capability claims are dangerous in this context because the skill is already aimed at bypassing anti-scraping controls; any ambiguity makes abuse harder to detect and review.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The finding indicates the skill claims substantial scraping and anti-bot functionality that is not actually implemented. False or inflated capability claims are dangerous in this context because the skill is already aimed at bypassing anti-scraping controls; any ambiguity makes abuse harder to detect and review.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file’s own description and comments explicitly position the skill as an anti-bot evasion scraper, including fingerprint spoofing, cookie bootstrapping, UA consistency, backoff tuning, and other measures intended to bypass platform defenses. In this context, the dangerous behavior is not incidental scraping but deliberate evasion of access controls and anti-abuse mechanisms, which materially increases the likelihood of unauthorized collection at scale and downstream legal, operational, and abuse risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly advertises anti-detection and anti-blocking tactics such as browser-header mimicry, randomized delays, automated backoff after blocking, and cookie management to continue scraping protected targets. In the context of a scraping skill aimed at bypassing anti-bot defenses, these features materially increase the capability to evade access controls and facilitate unauthorized large-scale collection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README explicitly documents collection and export of potentially sensitive vehicle-related fields such as VIN and dealer phone numbers, but does not include any privacy, minimization, retention, or lawful-use guidance. In the context of a scraping skill, this increases the risk that operators will collect and redistribute personal or quasi-sensitive data without safeguards, enabling privacy violations or downstream misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README promotes anti-detection techniques including cookie management, fingerprint randomization, interception detection, and proxy rotation, which are classic mechanisms for evading platform defenses and preserving unauthorized access. In this skill's context, those capabilities materially increase abuse potential by helping users bypass rate limits, bot detection, and session controls while scraping target sites.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises code-driven scraping and export behavior that inherently implies network access and file output, but the manifest does not declare any tool scope restrictions such as allowed tools or permissions. This creates an authorization ambiguity where an agent or user may invoke broader capabilities than expected, reducing oversight and increasing the chance of misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill documentation promotes anti-scraping collection, cookie handling, fingerprint spoofing, and export behavior without warning about privacy, terms-of-service, legal, or operational risks. In this context, omission of safety and compliance guidance makes the skill more dangerous because it normalizes evasive collection behavior and increases the chance of unauthorized or high-impact use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The Accept-Language pool is hard-coded to Chinese-first locales only, which enforces a specific language/locale behavior rather than offering user choice. This matches the policy concern for locale constraints that are not opt-in or justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The generated fingerprint always sets language to zh-CN and timezone_offset to UTC+8, imposing a fixed locale profile on all users. There is no opt-in, configuration, or documented justification for this region-specific behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The scraper populates a VehicleInfo object with potentially sensitive fields from listing details, including VIN, dealer phone, address, and plate-related data, and later prints scraped records in the main entrypoint. While the code has logging and docstrings describing scraping, it does not clearly warn users that personally or commercially sensitive data may be collected and output.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The manifest describes vehicle list/detail scraping, price trends, and merchant information, but this implementation additionally extracts the vehicle VIN and dealer phone number as part of the detail payload. VIN collection is more sensitive than ordinary listing/detail data and is not justified by the stated manifest description or the documented OpenClaw-oriented output scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file’s natural-language description and inline comments are entirely in Chinese, with no indication that the skill supports other languages or that Chinese is a required, justified locale. The policy specifically calls for flagging language or locale constraints when they are imposed without user choice or explicit justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file header and implementation context explicitly position the skill as a 'universal anti-crawling' scraper and pair that with evasion features such as browser header spoofing, backoff to avoid blocking, cookie management, and fingerprint-style anti-detection support. This is dangerous because it facilitates bypassing site access controls and enables scalable unauthorized collection of marketplace data, making abuse more likely than an ordinary scraper.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The code performs automated scraping requests and explicitly collects and stores cookies from the target site without any user-facing notice, consent flow, or policy guardrails. In a skill whose stated purpose is anti-detection scraping, silent cookie collection increases privacy, compliance, and misuse risk because session identifiers and tracking state can be harvested and replayed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The natural-language description and user-facing strings are entirely in Chinese, and the file presents the skill as a unified model for the broader OpenClaw import workflow without indicating any language choice. This can violate language/locale policy when a skill implicitly constrains interaction or outputs to a specific language without documented user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The scraper collects and stores dealer-related fields such as phone, address, and city as part of its normalized vehicle output, while the overall workflow is built for broad automated extraction. Even if some fields are publicly visible, bulk aggregation without disclosure, minimization, consent checks, or usage constraints can create privacy, compliance, and abuse risks, especially when combined with anti-bot evasion and scalable scraping behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.