Security audit

pepper-oil-scraper

Security checks for vulnerabilities and agentic risk

Overview

This is a domain-specific web scraper, but it needs Review because it encourages scraping protected sites and has unsafe install/export practices that could affect the user's environment or reports.

Install only in an isolated virtual environment, avoid the documented --break-system-packages command, and review target-site terms before crawling. Do not use the proxy/IP-switching or browser-automation guidance to bypass CAPTCHA, Cloudflare, signatures, or other access controls. Prefer HTTPS-only sources and sanitize Excel exports before opening or sharing generated workbooks.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:33
Finding: Unpinned Dependencies Installed into the System Python Environment
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/adapters/company_adapters.py:25
Finding: Plaintext HTTP Requests Permit Scraped Data and Financial Response Tampering
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/export_report.py:82
Finding: Scraped Content Is Exported to Excel Without Formula Neutralization
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description presents a comprehensive specialized skill for the 花椒油/藤椒油产业链 with many source types and broad data dimensions. This code chunk, however, only shows a media-adapter module for four content/news sites and primarily performs article scraping plus regex-based numeric extraction from text. That is related to the declared domain, so it is not wholly unrelated, but it materially underdelivers versus the stated breadth: no visible support here for raw material price collection, trade/import-export sources, structured financial report retrieval, or a large library of 20+ adapters. The primary behavior in this chunk is narrower: mine metrics from media articles mentioning relevant keywords. Therefore the description does not accurately represent what this supplied code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description emphasizes a dedicated crawler skill for acquiring industry-chain data about 花椒油/藤椒油 from many external websites and reports. However, this code does not fetch remote content, crawl websites, access APIs, or implement source-specific adapters. Instead, it reads a local JSON file and performs downstream processing: deduplication, unit conversion, outlier detection, categorization, and saving results. While these functions could support a larger scraping pipeline, this chunk's actual behavior is materially different from the declared primary purpose of web data collection. Therefore this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description emphasizes a dedicated data-crawling skill with many site adapters for collecting industry-chain data related to 花椒油/藤椒油. However, the supplied code only reads local JSON files, classifies records by metric keywords, and exports them to Excel or Markdown with formatting. It performs no network access, no scraping, no adapter dispatching, and no source-site collection logic. While the report categories align with the same domain, the primary purpose of this code chunk is post-processing/export, not data acquisition. Therefore the code behavior does not accurately match the declared purpose.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation criteria are overly broad, allowing the skill to trigger on vague requests like 'scrape data' whenever pepper-related context is present, and it further expands into a generic agricultural crawler template. In an autonomous agent system, this can cause the skill to perform unintended network activity, collect from unapproved sites, and write outputs without sufficiently specific user intent.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises the ability to perform network access and write outputs to disk, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, this increases the risk of overbroad execution because the skill may be invoked with more capabilities than necessary and without clear restrictions on what it can read, fetch, or write.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest description and invocation guidance are entirely in Chinese and oriented around Chinese-language trigger phrases, but the file does not indicate that this locale restriction is optional or region-specific by policy. Under the language/locale rule, forcing one language without opt-in can be a policy concern.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Describing the skill as a general agricultural-industry crawler template broadens its operational scope beyond the named domain without guardrails. That makes accidental or policy-violating invocation more likely, especially in agents that route tasks based on description text.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation instructs large-scale scraping and exporting to fixed filesystem paths but does not mention data integrity validation, terms-of-service considerations, rate/volume safeguards, or storage impact. In practice, this can lead to unreliable outputs, policy violations, excessive network activity, and uncontrolled writes to local or mounted directories.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This document goes beyond ordinary scraping guidance by explicitly recommending measures to cope with anti-crawl controls on protected sites, including IP switching and handling rate limits, CAPTCHAs, signatures, and Cloudflare-style defenses. In the context of a scraping skill, that materially increases the chance the agent will be used to bypass site access controls or terms of service rather than just collect publicly accessible industry data.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Playwright section recommends browser automation specifically for high-protection targets, including sites with CAPTCHA, JS-based protections, signatures, and dynamic loading. While browser automation can be legitimate, here it is framed as a way to access protected resources, which can facilitate anti-bot evasion and scaling of access to sites that intentionally restrict automated collection.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Natural-language content in the module docstring and subsequent comments assumes Chinese as the operating language, but there is no opt-in, alternative language, or documented locale-specific justification in this file. That can violate language/locale policy where user choice is required.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The natural-language descriptions and embedded assumptions are entirely Chinese-specific, including Chinese site coverage and Chinese keyword searches, with no indication that language or locale is optional. Under the policy, forcing a specific language/locale without user choice can be a violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code file contains user-facing natural-language strings that force a specific language/locale experience. Under the policy, language restrictions should either be optional for the user or clearly justified as region-specific, which is not present here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code includes source URLs and original extracted text in the generated report, which can expose scraped content or sensitive references when written to Excel or Markdown outputs. The file performs these exports without a confirmation prompt, explicit warning comment/docstring, or user-facing disclosure about the data being persisted.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The config explicitly restricts keyword coverage to zh and en, which is a natural-language locale choice embedded in the file. There is no accompanying indication that users can select other languages or opt into this locale limitation, so it may violate the policy against forcing a specific language/locale without user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file contains user-facing natural language only in Chinese, and there is no indication that the skill is region-specific or that users may choose another language. Under the policy rule for language or locale constraints, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This Python file contains user-facing natural-language text only in Chinese, such as the module docstring and inline comments. Under the stated policy, forcing a specific language without opt-in or documented justification can be a locale-policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: Altering sys.path changes runtime module loading behavior and can affect system integrity or execution context, but the code provides no explanatory comment or user-facing disclosure for this action. This is an environment-affecting operation that may surprise users or operators reviewing skill behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code issues HTTP requests to external finance and news sites through self.fetch and fetch_and_parse, including POST/GET queries containing company identifiers and search keywords. While the module docstrings describe scraping targets, there is no explicit user-facing warning, confirmation, or disclosure in the executing methods about outbound network activity.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The module docstring and inline natural-language descriptions are written entirely in Chinese, which can amount to a fixed language choice without any visible opt-in or alternative locale. Under the stated policy, forced language selection is a reportable natural-language issue unless the locale constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The scraper fetches target and search URLs via self.fetch_and_parse(...), which performs network activity against external media sites. In this file there is no confirmation prompt, user-facing log/print, or warning comment/docstring disclosing that external requests will be made.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The file-level docstring and multiple natural-language identifiers/instructions are written exclusively in Chinese, presenting the skill as operating in a fixed language context. Under the language/locale policy, forcing a specific language without offering choice or documenting a justified regional constraint can be a policy issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code fetches remote pages via fetch_and_parse for both configured target pages and search-result URLs, which is a network operation covered by the warning requirement for code files. In this file there is no confirmation prompt, user-facing log/print, or comment/docstring warning the user that external requests will be made.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The default headers hard-code Accept-Language: zh-CN,zh;q=0.9,en;q=0.8, which imposes a specific locale preference on all requests. This is a natural-language/locale policy concern because the file does not offer a user choice or explain why this locale restriction is required.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code file contains natural-language strings that present usage instructions only in Chinese. Under the policy, forcing a specific language without offering user choice or documenting a justified locale restriction is a violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.