Anycrawl

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:38 AM UTC
• Version: 1.0.1

Overview

This web-crawling skill is coherent, but its unpinned npm/npx execution path and command-line API-key example create risks users should review before installing.

Install only if you are comfortable with AnyCrawl network crawling and authenticated CLI use. Prefer a reviewed, pinned `anycrawl-cli` version, avoid `npx` fallback execution, avoid global installs where possible, and do not paste real API keys directly into shell commands; use a protected secret flow or carefully managed environment variable instead.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: rules/install.md:11

Finding

Unpinned and Inconsistently Named npm Packages May Execute Untrusted Code

Content

View full analysis

Remediation

View remediation

init ``` 3. Record and verify package integrity and provenance before execution. Where practical, use a lockfile and a trusted registry configuration. 4. Avoid global installation. Install the package as a project-local development dependency and invoke the locked local binary. 5. Do not automatically approve first-time package execution with `-y` unless the exact package version and provenance have already been verified. 6. Review npm lifecycle scripts and the transitive dependency tree before approving upgrades. 7. Ensure all documentation, tool permissions, and examples use one canonical package name. 8. Run the CLI with least privilege in an isolated environment, without unrelated credentials or sensitive files. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: rules/install.md:27

Finding

API Key Passed Through a Command-Line Argument

Content

View full analysis

" ``` ``` ### Technical Analysis The documented authentication method places the API key directly in a command-line argument. Depending on the operating system and execution environment, command-line arguments may be exposed through: - Shell history files. - Process inspection tools while the command is running. - Terminal session recording. - CI/CD logs and command tracing. - Endpoint monitoring, audit, or agent telemetry. - Copied scripts and troubleshooting transcripts. Quoting the key does not protect it from these disclosure channels. Although the same file also mentions the `ANYCRAWL_API_KEY` environment variable, environment variables may likewise be exposed through process inspection, diagnostic output, or inherited child processes unless carefully managed. ### Attack Path 1. A user replaces the placeholder with a real API key and runs the documented command. 2. The shell records the command in its history, or process/audit tooling captures its arguments. 3. Another local user, administrator, log reader, monitoring operator, or attacker with access to the resulting records obtains the key. 4. The attacker submits requests to AnyCrawl using the stolen credential. 5. The attacker retains access until the key is revoked, rotated, expires, or is otherwise invalidated. ### Impact Assessment The exposed credential may permit unauthorized use of the victim's AnyCrawl account within the permissions assigned to that API key. Potential consequences include consumption of paid quota, access to account-scoped functionality, unauthorized scraping activity attributed to the victim, and disclosure of any data made available to ...[truncated 197 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

This finding is substantively the same issue reflected at the manifest level: the skill definition permits use of npx anycrawl without version pinning. In security-sensitive agent workflows, unpinned runtime package execution increases exposure to malicious or altered upstream packages and reduces reproducibility and auditability.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description is broad enough that the skill may be selected for many generic web-related requests, increasing the chance of unnecessary external browsing, scraping, or crawling. In agent settings, overly broad activation boundaries can expand data exposure, trigger unintended network access, and make it easier for prompt-injected content from web pages to enter downstream workflows.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill allows execution via npx anycrawl * without pinning a specific package version. npx resolves and may fetch the latest published package, which creates a supply-chain risk: a compromised upstream release or typosquatted replacement could execute attacker-controlled code in the agent environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The installation command uses npx -y anycrawl-cli without pinning a specific package version. This creates a supply-chain risk because future or compromised releases could be fetched and executed automatically, and -y reduces friction for unattended execution. In an agent skill context, install instructions are especially sensitive because they directly influence what code gets run on the host.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · rules/install.md (reported line 39)May include surrounding context.

anycrawl login --api-key ""

text

Or run any command - you'll be prompted to enter your API key. Credentials are stored in `~/.config/anycrawl-cli/` (Linux/macOS) or `%APPDATA%/anycrawl-cli` (Windows).

### If authentication fails

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The fallback verification step npx anycrawl-cli --version also pulls and executes an unpinned package version. Even though it appears to be a harmless version check, it still causes code execution from the registry and can expose users to the same supply-chain compromise risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.