deep-scraper

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:05 AM UTC
• Version: 1.0.0

Overview

This is a real browser-based scraping skill, but it accepts arbitrary URLs in a weakly isolated Docker browser environment without enough scope controls or safety disclosure.

Review carefully before installing. Use only for public pages you are authorized to scrape, run it in a strongly isolated container or VM with restricted outbound network access, mount code read-only, avoid private/internal URLs and authenticated content, and pin/review the runtime image and npm dependencies first.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: assets/main_handler.js:9

Finding

Unrestricted target URL enables server-side request forgery and internal network access

Content

View full analysis

document.body.innerText); console.log(JSON.stringify({ status: 'SUCCESS', type: 'GENERIC', title, data: content.substring(0, 10000) })); } ``` It is then submitted to Crawlee without validation: ```javascript crawler.run([targetUrl]); ``` The same issue exists in `assets/youtube_handler.js`: ```javascript const targetUrl = process.argv[2]; const videoId = targetUrl.split('v=')[1]?.split('&')[0]; // ... await page.goto(targetUrl, { waitUntil: 'networkidle' }); // ... crawler.run([targetUrl]); ``` ### Technical Analysis Both handlers treat a command-line argument as a trusted navigation target. There is no URL parser, protocol restriction, hostname allowlist, DNS resolution check, or rejection of loopback, private, link-local, and container-internal addresses. The documented `main_handler.js` interface intentionally supports generic URLs, meaning an attacker who can control the argument can instruct the browser to request services reachable from the scraper environment. The page title and body text are returned through standard output, so responses from HTTP-based internal services m ...[truncated 2504 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: assets/main_handler.js:16

Finding

Chromium sandbox is disabled while processing untrusted web content

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (11)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · assets/main_handler.js (reported line 31)May include surrounding context.

js

async requestHandler({ page, log }) {
        log.info(`Deep-Scraper starting in ${mode} mode for: ${targetUrl}`);

        // Clear context to ensure a fresh session (avoid cache leakage)
        const context = page.context();
        await context.clearCookies();

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill is described as a general-purpose 'deep web scraping' tool for bypassing protections on sites like YouTube and X/Twitter, but it does not narrowly define permitted use cases or safety boundaries. Broad invocation guidance increases the chance the agent will apply the skill to inappropriate targets, including sites with restrictions, sensitive content, or terms-of-service constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill omits a clear warning that user-supplied URLs and retrieved page content will be transmitted into a containerized browser automation environment. That matters because scraping may process sensitive URLs, session-dependent content, or regulated data, and users are not clearly informed about the data flow or trust boundary.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The header comment frames the file as a general scraper optimized for container execution, but the implementation branches into targeted YouTube-specific behavior, including intercepting timedtext API requests and extracting transcripts. This is more than an omitted detail: the documented intent suggests generic scraping, while the code performs a specialized media-transcript extraction workflow.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

Standard Interface (CLI)

bash

docker run -t --rm -v $(pwd)/skills/deep-scraper/assets:/usr/src/app/assets skillboss-crawlee node assets/main_handler.js [TARGET_URL]

Output Specification (JSON)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This file contains Chinese-only operational messages such as "正在尝试强制抓取视频内容" and later similar Chinese console output. That imposes a specific language on users/operators without any opt-in or fallback, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The comment at L30 says the code will 'completely clear cache and cookies to ensure a fresh load', but the implementation at L31-L32 only calls clearCookies() and does not clear browser cache or other site storage. This is a direct documentation-to-code mismatch, even though it is not a severe security issue by itself.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency uses a caret range instead of an exact pinned version, so future installs may resolve to different releases than were originally tested. This weakens build reproducibility and can unintentionally introduce vulnerable or malicious upstream changes into a containerized scraping skill that fetches and executes third-party browser automation code.

Content

Scanner excerpt · package.json (reported line 19)May include surrounding context.

json

"author": "Joseph",
  "license": "MIT",
  "dependencies": {
    "crawlee": "^3.0.0",
    "playwright": "^1.40.0"
  },
  "skillboss": {

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Playwright is also specified with a caret range, allowing different minor/patch releases to be installed over time. In this skill's context, Playwright is especially sensitive because it drives browser automation and may download browser binaries, increasing supply-chain and reproducibility risk if dependency resolution changes unexpectedly.

Content

Scanner excerpt · package.json (reported line 20)May include surrounding context.

json

"license": "MIT",
  "dependencies": {
    "crawlee": "^3.0.0",
    "playwright": "^1.40.0"
  },
  "skillboss": {
    "requires": {

Unverifiable Dependency: playwright has 1 known advisory(ies) (CVE-2025-59288 (Playwright downloads and installs browsers without verifying the authenticity of)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The manifest references Playwright without pinning an exact version, while the package is noted as having a known advisory affecting some releases. Because the installed version may vary, it is impossible to verify from this manifest alone whether deployments are exposed; in this scraping skill, that uncertainty matters more because Playwright may download and install browser components, amplifying authenticity and supply-chain concerns.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.