Scrapling Web Fetch

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:16 PM UTC
• Version:
  1.0.2

Overview

This skill coherently fetches user-specified web pages and converts article content to Markdown, with no evidence of hidden persistence, credential access, or unrelated data handling.

Install this only if you are comfortable with a Python helper that fetches arbitrary URLs you provide and optionally reads batch or selector files you point it at. Use a controlled Python environment, consider pinning dependencies for repeatability, and treat fetched web content as untrusted text before acting on it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructs the agent to read local files under absolute paths and perform outbound network fetches, but it does not declare any permissions or trust boundaries. This can cause the agent or platform to execute capabilities the user did not explicitly approve, especially since the skill is designed to fetch arbitrary URLs and reference local workspace files.

VirusTotal

66/66 vendors flagged this skill as clean.