Web Crawler

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:30 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Node.js crawler guide, with expected network crawling and local output examples but some setup and TLS-safety caveats users should notice.

Install only in a normal project or sandbox, pin and review the npm dependency for serious use, keep crawler targets and rate limits explicit, save outputs only to intended paths, and do not use `rejectUnauthorized: false` outside local debugging with non-sensitive traffic.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:27
Vulnerability Type: Unpinned and mutable third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

sh

npm install crawler

Technical Analysis

The installation command does not specify an exact version of the crawler package and does not require a reviewed lockfile or package integrity value. Consequently, the package resolved by npm can change after the Skill has been audited.

Installing an unpinned package exposes users to supply-chain risks arising from a compromised maintainer account, malicious package release, package ownership transfer, or an unintentionally incompatible future version. npm installation may also execute package lifecycle scripts, so a malicious release could run code during installation rather than waiting for the crawler to be imported.

The audit found no evidence that the current crawler package is malicious. The vulnerability is the Skill's unsafe, mutable dependency-installation practice.

Attack Path

1. An attacker compromises the package publisher, release process, or another dependency in the resolved dependency tree.
2. The attacker publishes a malicious version under the legitimate package name or introduces malicious lifecycle/runtime code.
3. A user follows the Skill instruction and runs npm install crawler.
4. npm resolves the mutable current release rather than a previously audited exact version.
5. Malicious lifecycle code may execute during installation, or malicious runtime code may execute when the generated crawler imports and uses the package.

Impact Assessment

Dependency code executes with the privileges of the account running npm or Node.js. A compromised dependency could therefore read or modify files accessible to that account, access environment variables and application credentials, initiate outbound network connections, alter generated crawler results, or execute arb ...[truncated 222 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the package to an exact, reviewed version, for example npm install --save-exact crawler@<reviewed-version>.
• Commit a reviewed package-lock.json and use npm ci in automated or production environments.
• Verify registry provenance and package integrity before installation.
• Review both direct and transitive dependencies with npm audit and an appropriate software-composition analysis tool.
• Consider initially installing with lifecycle scripts disabled, where compatible with the package: npm ci --ignore-scripts.
• Use a restricted, nonprivileged build environment with limited filesystem, credential, and network access.
• Establish an explicit dependency-update process so new releases are reviewed and tested before adoption.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/examples.md:163

Finding

TLS Certificate Verification Disabled in HTTP/2 Proxy Example

Content

View full analysis

Vulnerability Details

File Locations: SKILL.md:147; references/examples.md:163-169
Vulnerability Type: Disabled TLS peer-certificate validation
Risk Level: Medium

Vulnerable Code Snippet from SKILL.md:147:

text

When using Charles or self-signed certs, add `rejectUnauthorized: false`.

Vulnerable Code Snippet from references/examples.md:163-169:

js

c.add({
  url: "https://example.com",
  http2: true,
  proxy: "http://127.0.0.1:8888",
  rejectUnauthorized: false,
  callback: (e, res, done) => { done(); },
});

Technical Analysis

Setting rejectUnauthorized: false disables verification of the remote TLS certificate. The client can consequently accept expired, self-signed, hostname-mismatched, or attacker-issued certificates without establishing that the endpoint is the intended server.

The example is presented for use with Charles or self-signed certificates and points to a loopback proxy. Nevertheless, copied or generalized use of this setting removes HTTPS server authentication for the affected request. Encryption without certificate authentication does not prevent an active intermediary from impersonating the destination and modifying responses.

Attack Path

1. A developer copies the example and retains rejectUnauthorized: false outside a tightly controlled local debugging environment.
2. An attacker gains a network interception position, compromises the configured proxy, changes proxy routing, or redirects the destination through DNS or network manipulation.
3. The attacker presents an arbitrary certificate for the requested host.
4. The crawler accepts the certificate because verification is disabled.
5. The attacker observes or modifies requests and responses returned to the crawler.
6. The application processes attacker-controlled HTML, structured data, or downloaded files as though they came from the legitimate site.

Impact Assessment

...[truncated 638 chars]

Remediation

View remediation

Remediation Suggestions

• Keep certificate verification enabled by default and remove rejectUnauthorized: false from general-purpose examples.
• Trust the debugging proxy's specific root CA through the applicable got or Node.js certificate-authority option rather than disabling verification globally.
• Store development CA certificates securely and scope their use to explicit local debugging configurations.
• Separate development and production configuration so insecure TLS flags cannot be enabled in production.
• If an exceptional temporary bypass must remain documented, label it prominently as development-only and fail startup when it is enabled in production.
• Avoid transmitting real credentials, session cookies, or sensitive data through debugging proxies.
• Add automated configuration checks that reject rejectUnauthorized: false in deployed crawler tasks.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest frames this skill as a Node.js web crawler for large-scale scraping, downloading, and parsing, but these examples also demonstrate writing fetched content directly to the local filesystem. While batch downloading is mentioned in the manifest, persistent local file output is a materially broader operational behavior than pure crawling/parsing and is not described in the file's surrounding documentation here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file includes a worked example that downloads remote content and saves it locally with fs.writeFileSync. The surrounding description presents the behavior as a normal example but does not warn that it writes files to disk, which is a user-data/system-affecting action covered by the markdown criteria for missing warnings.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The full spider example does more than crawl and extract data in memory: it persists aggregated results to a local JSON file. The manifest emphasizes large-scale crawling and extraction features, but does not clearly state that the skill produces local filesystem side effects by default or through typical usage examples.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The full spider example persists collected data to results.json via fs.writeFileSync, which affects the local filesystem. The markdown section describes crawling and extraction but does not disclose that running the example will create or overwrite a file.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/options.md (reported line 218)May include surrounding context.

md

### `crawler.add(url | options)`

Add a task to the queue. Accepts a URL string, an options object, or an array
of either.

### `crawler.send(options)`

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file includes a sample that writes response data directly to a local filename via fs.writeFileSync, which modifies user data on disk. The surrounding documentation describes the mechanism but does not warn about overwrite risk, destination safety, or the fact that running the example will create or replace local files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.