T09 · Insecure Skill Coding Practices
Error
- Location
assets/main_handler.js:8- Finding
Unrestricted User-Controlled URL Navigation Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
Deep Scraper + Amazon
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real web-scraping skill, but it can browse and return data from arbitrary URLs without enough safeguards against internal or unintended targets.
Install only if you are comfortable with a Dockerized browser scraper that can contact arbitrary third-party sites and print retrieved content. Use it with explicit public URLs only, avoid authenticated/private/internal targets, block container access to local networks and metadata services, and rebuild from reviewed, pinned dependencies and image provenance before using it in a sensitive environment.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
assets/amazon_handler.js:3- Finding
Amazon Handler Does Not Enforce an Amazon Destination and Permits SSRF
- Content
View full analysis
a.startsWith('http')); const maxPages = parseInt(args.find((a, i) => args[i-1] === '--pages') || '1'); ``` Page-type detection does not validate the destination: ```javascript function detectPageType(url) { if (url.includes('/zgbs/') || url.includes('/bestsellers/')) return 'bestsellers'; if (url.includes('/zg/new-releases/')) return 'new-releases'; if (url.includes('/zg/movers-and-shakers/')) return 'movers-shakers'; if (url.includes('/dp/') || url.includes('/gp/product/')) return 'product-detail'; if (url.includes('/s?') || url.includes('/s/')) return 'search'; return 'generic'; } ``` The resulting URL is navigated directly: ```javascript let url = targetUrl; if (pg > 1) url = targetUrl.includes('?') ? `${targetUrl}&pg=${pg}` : `${targetUrl}?pg=${pg}`; log.info(`Page ${pg}/${maxPages}: ${url}`); await page.goto(url, { waitUntil: 'domcontentloaded', timeout: 60000 }); ``` ### Technical Analysis The handler is documented as an Amazon scraper, but it accepts any argument beginning with the text `http`. This check neither performs structured URL parsing nor confirms that the hostname belongs to Amazon. For unrecognized paths, the handler enters its generic fallback and returns page body content. Consequently, a caller can use the Amazon-specific entry point to request arbitrary resources accessible from the container. Path substring checks only determine how the response is parsed. They do not prevent requests to non-Amazon hosts. Redirect destinations, DNS resolutions, and private or link-local addresses are not checked. ### Attack Path 1. An attacker invokes the Amazon handler with an HTTP or HTTPS URL ta ...[truncated 1145 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
assets/youtube_handler.js:3- Finding
Standalone YouTube Handler Navigates to an Unvalidated User-Supplied URL
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (22)
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
js async requestHandler({ page, log }) { log.info(`Deep-Scraper starting in ${mode} mode for: ${targetUrl}`); // Clear context to ensure a fresh session (avoid cache leakage) const context = page.context(); await context.clearCookies();
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill clearly instructs use of network-capable Dockerized scraping, but it declares no explicit tool scope or permissions boundaries. That creates a governance gap where an agent may invoke broad network access without transparent authorization, increasing the risk of unintended scraping, policy violations, or misuse against arbitrary targets.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list is extremely broad and includes common terms like 'extract', 'fetch data', 'search results', and generic website-content phrases, making accidental invocation likely. In an agent setting, overbroad routing can cause unintended network access, scraping of user-supplied or discovered sites, and collection of third-party data outside user expectations or policy boundaries.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The generic-mode activation condition effectively routes any non-Amazon, non-YouTube URL or broad 'social media' scraping request into a networked scraper. That ambiguity increases the chance of the agent being used against arbitrary websites, which raises SSRF-like governance concerns, privacy issues, and unauthorized scraping risk even if the skill is intended for legitimate data collection.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill describes scraping arbitrary websites and social-media content but does not clearly warn about the implications of network access, site terms, privacy-sensitive data collection, or restrictions on authenticated/private content. In context, this omission is more dangerous because the skill is expressly designed for broad scraping and anti-bot evasion, so users and orchestrators may underestimate the operational and compliance risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code sets the Accept-Language header to 'en-US,en;q=0.9', which imposes a specific language/locale on all requests. This is a natural-language policy concern because users are given no opt-in, override, or justification for the locale restriction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The script prints a full JSON payload containing scraped product and page metadata to stdout, which can expose collected site content and URLs to downstream logs or calling systems. While the script logs progress, there is no explicit comment, prompt, or user-facing disclosure in this file warning that retrieved page data will be collected and emitted.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The YouTube path listens to browser network requests, extracts a transcript API URL, and then fetches transcript data from that remote endpoint. While this behavior is central to scraping, the file's visible documentation only shows a target URL argument and does not warn users that network traffic will be monitored and additional remote requests will be made to collect transcript content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
In generic mode, the script performs a network navigation to an arbitrary user-supplied URL, which can transmit request metadata and potentially expose the execution environment's IP or other system context. Although the file logs that scraping is starting, there is no clear disclosure in comments, prompts, or usage text that the script will contact third-party sites and retrieve their content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code emits Chinese log/output strings and relies on Chinese UI text such as '转录稿'/'转录' when interacting with the page. This enforces a specific language/locale behavior without user opt-in or configuration, which fits the language/locale policy violation category.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The script visits a user-supplied YouTube URL, monitors network requests, and fetches transcript data, but only emits internal progress logs and no user-facing warning about transmitting data to YouTube or collecting page/transcript content. Under the code-file criteria, network/HTTP operations that transmit or retrieve user/system data should have some visible disclosure unless clearly documented elsewhere, which is not present in this file.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
When transcript capture fails, the code silently pivots to collecting and returning the video's visible description instead. That expands data collection beyond the apparent transcript-only purpose, creating a scope-creep/privacy issue and increasing the chance of returning content the caller did not explicitly request or expect.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The fallback rule instructing the agent to first search for a URL and then scrape it expands the skill from user-directed extraction into autonomous target discovery plus scraping. That broadens the blast radius because the agent may select and access third-party sites the user did not explicitly authorize, increasing the chance of policy, privacy, or compliance violations.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
The dependency uses a caret range, which allows newer minor/patch releases to be installed over time instead of a single audited version. In a security-sensitive scraping skill that drives browsers and fetches remote content, this weakens supply-chain reproducibility and can silently introduce vulnerable or malicious updates.
- Content
json "author": "Joseph", "license": "MIT", "dependencies": { "crawlee": "^3.0.0", "playwright": "^1.40.0" }, "openclaw": {
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The Playwright dependency is not pinned to an exact version, so builds may resolve to different releases over time. This is more concerning here because Playwright executes browser automation and may download browser binaries, increasing supply-chain and environment compromise risk if a bad release or vulnerable version is pulled.
- Content
json "license": "MIT", "dependencies": { "crawlee": "^3.0.0", "playwright": "^1.40.0" }, "openclaw": { "requires": {
Unverifiable Dependency: playwright has 1 known advisory(ies) (CVE-2025-59288 (Playwright downloads and installs browsers without verifying the authenticity of)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
The manifest references Playwright with a non-exact version, and Playwright has a cited advisory related to downloading/installing browsers without verifying authenticity. Because the version is not pinned, it is not possible to prove this skill avoids affected releases, which is risky in a containerized scraper that relies on automated browser setup.
- Content
Static analysis
No suspicious patterns detected.