Auto Scraping to CSV

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:03 AM UTC
• Version: 1.0.1

Overview

This scraping skill is not proven malicious, but it exposes broad browser-control powers and unsafe credential handling that users should review before installing.

Install only if you are comfortable running a local browser-control server and reviewing or hardening it first. Do not provide passwords, tokens, or one-time codes through chat; log in manually in a browser instead. Prefer pinning or vendoring the Page-Agent script, binding the server to localhost with authentication, removing executeJavascript unless explicitly needed, and scraping only data you are authorized to collect.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: page-agent-bridge.mjs:25

Finding

Unpinned Third-Party Script Is Downloaded and Executed in Every Browser Session

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: page-agent-bridge.mjs:226

Finding

Unauthenticated Network API Exposes Browser Control and Arbitrary Page-Context JavaScript Execution

Content

View full analysis

{ ``` ### Technical Analysis The HTTP bridge does not authenticate clients or authorize operations. It exposes endpoints capable of creating browser sessions, reading simplified DOM state, navigating to URLs, clicking elements, entering text, executing caller-supplied JavaScript, deleting sessions, and shutting down the service. Calling `server.listen(PORT)` without a host commonly binds Node.js to an unspecified address, making the service potentially reachable through non-loopback interfaces. In addition, `Access-Control-Allow-Origin: *` allows JavaScript hosted by any origin to submit cross-origin requests to the bridge. Although private-network browser controls may affect some environments, CORS is not a valid authentication mechanis ...[truncated 1945 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: page-agent-bridge.mjs:137

Finding

Unrestricted Browser Navigation Enables Server-Side Request Forgery and Internal-Network Access

Content

View full analysis

= MAX_SESSIONS) { throw new Error(`Maximum ${MAX_SESSIONS} concurrent sessions reached.`); } const id = randomUUID().slice(0, 8); const browser = await chromium.launch({ headless }); const context = await browser.newContext({ viewport }); const page = await context.newPage(); // Navigate and inject Page-Agent IIFE await page.goto(url, { waitUntil: 'networkidle', timeout: 30000 }); await page.addScriptTag({ url: CDN_URL }); ``` The navigation endpoint also accepts an unrestricted URL: ```javascript async function navigate(id, url) { const s = getSession(id); await s.page.goto(url, { waitUntil: 'networkidle', timeout: 30000 }); return { url }; } ``` ```javascript const navMatch = url.pathname.match(/^\/sessions\/([a-zA-Z0-9-]+)\/navigate$/); if (navMatch && req.method === 'POST') { const id = navMatch[1]; const body = await readBody(req); if (!body?.url) { send(400, { error: 'url is required' }); return; } const result = await navigate(id, body.url); send(200, result); return; } ``` ### Technical Analysis The bridge performs no validation of the destination scheme, hostname, resolved IP address, port, redirect chain, or final destination. A caller can direct Chromium to resources available from the host environment, including loopback services, private network systems, and potentially cloud metadata endpoints. Because the bridge also exposes browser state and arbitrary JavaScript execution, it can act as a read-capable SSRF mechanism rather than merely a blind connectivity probe. Bro ...[truncated 1701 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:165

Finding

Skill Instructions Solicit User Passwords Without a Safe Credential-Handling Boundary

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly instructs the agent to ask users for login credentials to continue scraping authenticated pages, which expands the skill from webpage extraction into credential collection. This is dangerous because credentials may be exposed to the host model, logs, transcripts, or insecure bridge components, creating account-compromise risk well beyond the stated scraping purpose.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 93% confidence

Finding

The bridge API exposes powerful session-control and arbitrary JavaScript execution primitives (executeJavascript, session deletion, and shutdown). In an agent-driven skill operating on arbitrary webpages, this broad capability can be abused to run unintended scripts in page context, manipulate authenticated sessions, or terminate service if access controls are weak or the agent is prompt-influenced into unsafe actions.

Content

Scanner excerpt · SKILL.md (reported line 444)May include surrounding context.

{ "action": "executeJavascript", "params": { "script": "return document.title;" } }

text

### `DELETE /sessions/:id`
Close session.

### `POST /shutdown`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · page-agent-bridge.mjs (reported line 20)May include surrounding context.

js

*   GET    /sessions/:id/state              → get text-based DOM state
 *   POST   /sessions/:id/act                → execute one Page-Agent action
 *   POST   /sessions/:id/navigate           → navigate to new URL
 *   DELETE /sessions/:id                    → close browser session
 *   POST   /shutdown                        → stop bridge server
 */

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · page-agent-bridge.mjs (reported line 325)May include surrounding context.

js

*   GET    /sessions/:id/state              → get text-based DOM state
 *   POST   /sessions/:id/act                → execute one Page-Agent action
 *   POST   /sessions/:id/navigate           → navigate to new URL
 *   DELETE /sessions/:id                    → close browser session
 *   POST   /shutdown                        → stop bridge server
 */

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The bridge exposes an 'executeJavascript' action that forwards arbitrary caller-supplied script into the live browser context. That greatly exceeds the stated scraping purpose and enables any client that can reach the HTTP service to run code in visited pages, manipulate authenticated sessions, extract DOM data, or trigger arbitrary browser-side actions.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The bridge exposes unauthenticated destructive control over sessions via DELETE, and nearby code also exposes unauthenticated server shutdown. Any local or network-reachable client can terminate active browser sessions or stop the bridge, causing denial of service and potentially disrupting automation that may hold authenticated web state.

Content

Scanner excerpt · page-agent-bridge.mjs (reported line 264)May include surrounding context.

js

return;
    }

    // DELETE /sessions/:id
    const delMatch = url.pathname.match(/^\/sessions\/([a-zA-Z0-9-]+)$/);
    if (delMatch && req.method === 'DELETE') {
      const id = delMatch[1];

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest says no external LLM is needed, but the skill documentation explicitly shows 'Claude (Host Model)' receiving page state, understanding structure, deciding actions, and asking clarifying questions. That is a direct semantic mismatch about how the skill operates, not merely an implementation detail.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This is an internal documentation contradiction: the introductory description says no external LLM is required, while later documentation explicitly assigns core reasoning and control flow to Claude. The two statements cannot both be true as written.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill encourages extraction of potentially sensitive data such as employee details, emails, social engagement data, and directory information into CSV without any privacy, consent, or compliance warning. In a scraping context, omission of these safeguards materially increases the risk of collecting, storing, or redistributing personal data inappropriately.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation presents credential collection as normal behavior without a strong warning about the sensitivity of passwords or safer alternatives. In context, this increases the chance that users will reveal secrets in plain text to an agent-driven workflow, enabling accidental leakage through chat history or logs.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill directly instructs the agent to request Username/email and Password in plain language, which is a classic secret-handling anti-pattern. This creates a clear path for sensitive credential capture by the model, transport, logs, and any integrated tooling, making account takeover or unauthorized reuse possible if mishandled.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file implements an HTTP server for launching browser sessions, navigating, retrieving DOM state, and performing low-level actions, but it contains no CSV export logic and no structured-data extraction workflow. This behavior is materially broader and lower-level than the manifest's description of a skill that scrapes webpages and exports data to CSV.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code accepts remote action requests that can click elements, type text, execute JavaScript, and navigate pages, all of which can modify browser state or trigger real actions on websites. Although the file documents the endpoints, it does not provide a user-facing warning, confirmation step, or explicit safety disclosure about these side effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The bridge initializes PageAgent with language: 'en-US', which forces a specific locale choice in the skill behavior. There is no indication in this file that the user can opt into or override that locale, which conflicts with the policy against imposing a language without user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The bridge exposes session closure and full server shutdown functionality that can terminate active browser sessions and stop the service. While these operations are implemented intentionally, there is no explicit user warning or disclosure in the file that these endpoints are destructive to current session state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.