ClawHub
Back to skill

Security audit

Scrapling

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate web-scraping skill, but it needs Review because it can fetch arbitrary URLs, use stealth/browser scraping, and handle sessions without clear safeguards.

Install only if you intend to run a powerful scraper. Use it in an isolated environment with restricted network egress, avoid private or internal URLs unless explicitly authorized, do not hardcode credentials, clear any saved cookies or DOM snapshots, and pin dependencies before production use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/extract_with_scrapling.py:65
Finding

Unrestricted URL Fetching Enables Server-Side Request Forgery

Content
View full analysis

Vulnerability Details

File Location: scripts/extract_with_scrapling.py, lines 65-81
Vulnerability Type: Server-Side Request Forgery through insufficient URL validation
Risk Level: High

Vulnerable Code

python
def _fetch_url(url: str, fetcher_type: str, timeout: int) -> Any:
    try:
        if fetcher_type == "dynamic":
            from scrapling.fetchers import DynamicFetcher  # type: ignore

            log.info("Fetching with DynamicFetcher: %s", url)
            page = DynamicFetcher().fetch(url, timeout=timeout * 1000)
        elif fetcher_type == "stealthy":
            from scrapling.fetchers import StealthyFetcher  # type: ignore

            log.info("Fetching with StealthyFetcher: %s", url)
            page = StealthyFetcher().fetch(url, timeout=timeout * 1000)
        else:
            from scrapling.fetchers import Fetcher  # type: ignore

            log.info("Fetching with Fetcher (auto_match): %s", url)
            page = Fetcher.auto_match(url, auto_save=True, disable_adaptive=False)

The URL originates from the command-line interface without validation:

python
source.add_argument("--url", help="HTTP(S) URL to fetch with Scrapling Fetcher.")
python
if args.url:
    page = _fetch_url(args.url, args.fetcher, args.timeout)

Technical Analysis

The helper passes a caller-controlled URL directly to static, dynamic, or stealth browser fetchers. It does not parse the URL, enforce the advertised HTTP or HTTPS schemes, resolve and validate the destination address, restrict destination hosts, or reject loopback, private, link-local, reserved, and cloud metadata address ranges.

The implementation also does not demonstrate validation of redirect destinations. Consequently, validating only the initial hostname outside this helper would not be sufficient: an attacker-controlled public URL could redirect the fetcher to a prohibited internal destinatio ...[truncated 1544 chars]

Remediation
View remediation

Remediation Suggestions

  1. Parse every URL with a strict URL parser and allow only http and https.
  2. Require an explicit allowlist of permitted hostnames when the intended targets are known.
  3. Resolve all destination hostnames before connecting and reject every resolved loopback, private, link-local, multicast, unspecified, reserved, and documentation address.
  4. Revalidate DNS results at connection time to reduce DNS-rebinding exposure.
  5. Disable redirects by default or validate the scheme, hostname, and resolved addresses at every redirect hop.
  6. Apply the same policy to requests initiated by dynamic or stealth browser pages, including subresources and JavaScript-generated requests.
  7. Block sensitive destinations at the network layer through egress firewall rules in addition to application validation.
  8. Run the scraper in an isolated container or network namespace without access to cloud metadata endpoints, control planes, or private administrative networks.
  9. Set request-size, response-size, timeout, and redirect-count limits to reduce resource-exhaustion risks.
  10. Add tests covering IPv4 and IPv6 loopback addresses, private ranges, encoded IP forms, DNS rebinding, mixed-scheme URLs, user-info parsing, and public-to-private redirects.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:32
Finding

Unpinned Third-Party Packages and Browser Components Create Supply-Chain Exposure

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 32-41
Vulnerability Type: Unpinned and mutable dependency installation
Risk Level: Medium

Vulnerable Instructions

text
1. Install base package:
   - `pip install scrapling`
2. Install fetchers when browser-based fetching is needed:
   - `pip install "scrapling[fetchers]"`
   - `scrapling install`
   - `python3 -m playwright install` (required for DynamicFetcher and StealthyFetcher)
3. Install optional extras as needed:
   - `pip install "scrapling[shell]"` for shell + `extract` commands
   - `pip install "scrapling[ai]"` for MCP capabilities

Technical Analysis

The setup instructions install Scrapling, optional extras, and browser components without version constraints, hashes, a lockfile, or integrity-verification guidance. Each installation can therefore resolve to mutable artifacts available at installation time rather than to a specifically reviewed dependency set.

The fetchers, shell, and ai extras expand the transitive dependency and executable attack surface. The scrapling install and Playwright installation commands may also download and install additional components. If an upstream account, release, package index, dependency, or download channel is compromised, installation could execute or introduce attacker-controlled code with the installing user's permissions.

No evidence indicates that the named Scrapling package is malicious. The finding concerns the absence of dependency pinning and artifact verification, not a confirmed compromise of the dependency.

Attack Path

  1. A user or automated agent follows the Quick Setup instructions.
  2. The package manager resolves the latest currently available Scrapling release and its transitive dependencies.
  3. Additional installer commands retrieve mutable browser or fetcher components.
  4. A compromised or unexpectedly changed upstream artifact is downloaded becaus ...[truncated 731 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin Scrapling, Playwright, and all transitive dependencies to reviewed versions.
  2. Provide a lockfile or fully resolved requirements file containing cryptographic hashes.
  3. Install Python dependencies with pip install --require-hashes -r requirements.txt.
  4. Pin and verify browser component versions or checksums where the upstream tooling supports it.
  5. Use a controlled package mirror or explicitly trusted package index.
  6. Separate optional fetchers, shell, and ai dependencies so users install only the capabilities required for a task.
  7. Perform installation in an unprivileged virtual environment or isolated container rather than as an administrator.
  8. Add automated dependency scanning, provenance verification, and scheduled review of version updates.
  9. Document the expected package source, approved versions, and reproducible installation procedure.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill advertises and demonstrates network access and references local helper scripts, but it declares no explicit tool scope or permissions boundaries. In agent environments, missing scope declarations can cause overbroad access or ambiguous enforcement, increasing the chance the skill is invoked with capabilities the user did not intend.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The description is broad enough to trigger on generic requests to scrape, crawl, or automate website data collection, including anti-bot and protected targets, without clear guardrails. This can lead to inappropriate invocation for sensitive targets, legal-risk scenarios, or collection beyond what the user explicitly authorized.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The session-based example shows submitting credentials and persisting cookies for authenticated scraping, but it provides no warning about secret handling, storage, or transmission risks. In an agent setting, this may normalize collecting or reusing credentials and session state without adequate user consent, redaction, or secure storage practices.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The reference shows network fetching, cookie-persisting sessions, and file output without any warning that using the skill can contact external sites, retain session state, or write artifacts to disk. In practice, this can lead to unintended data disclosure, persistence of sensitive cookies, and surprising side effects, especially because the skill also advertises stealth and anti-bot capabilities.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The trigger examples are broad enough to match many ordinary user requests, which can cause the skill to activate in situations where the user did not explicitly intend web scraping or automation. In a skill that performs network access and potentially anti-bot scraping, over-broad activation increases the chance of unintended external requests and misuse of elevated capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

This code performs outbound HTTP(S) requests to arbitrary user-provided URLs via Scrapling fetchers. Although it logs that a fetch is occurring, there is no user-facing warning or comment/docstring explaining that remote requests will transmit the target URL and associated request metadata to external systems.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.