Gumtree UK — bb-browser

PassAudited by ClawScan on May 11, 2026.

Overview

This appears to be a read-only Gumtree UK search/listing adapter; the main cautions are the external bb-browser setup and staying within Gumtree URLs.

Before installing, make sure you are comfortable installing the bb-browser CLI globally and copying these adapters into ~/.bb-browser. Use it for public Gumtree searches/listings only, and avoid passing unrelated URLs to the listing command.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the global dependency adds a local command that can run these adapters when invoked.

Why it was flagged

The skill depends on an external global npm package rather than a pinned install specification. This is central to the skill's purpose, but users should trust the package source before installing.

Skill content

bb-browser installed globally (`npm i -g bb-browser`).

Recommendation

Install bb-browser only from a trusted source, review updates, and copy only the adapter files supplied with this skill.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If given a non-Gumtree URL, the adapter may fetch and parse an unrelated web page.

Why it was flagged

Path-only inputs are constrained to Gumtree, but full http(s) URLs are fetched as provided. That is broader than the stated Gumtree-only listing purpose.

Skill content

if (!path.startsWith('http')) { ... path = 'https://www.gumtree.com' + path; }

const resp = await fetch(path, {

Recommendation

Use only Gumtree listing URLs, or add host validation so full URLs must resolve to www.gumtree.com.