Scrapeless LLM Chat Scraper Skill

PassAudited by ClawScan on May 1, 2026.

Overview

This looks like a straightforward Scrapeless API wrapper, but it requires a Scrapeless API token and sends your prompts to Scrapeless.

Before installing, make sure you trust Scrapeless with the prompts you submit, keep X_API_TOKEN secret, monitor API usage, and install the Python dependencies in an isolated environment.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Anyone using the skill must provide an API token, so misuse or exposure of that token could affect the user's Scrapeless account or billing.

Why it was flagged

The skill requires a Scrapeless API token, which gives the skill authenticated authority to create and retrieve Scrapeless scraper tasks.

Skill content

credentials:
  - X_API_TOKEN
env:
  required:
    - X_API_TOKEN

Recommendation

Use a token intended for this integration, store it securely, monitor usage, and rotate it if it may have been exposed.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Prompts, country/mode settings, and resulting task data may be processed by Scrapeless, so confidential prompts could be shared with a third party.

Why it was flagged

The script sends the user's prompt and options to the Scrapeless API, which is expected for this skill but means the data leaves the local environment.

Skill content

self.api_base_url = 'https://api.scrapeless.com'
...
'prompt': prompt,
'country': country
...
response = requests.post(..., json=payload, timeout=30)

Recommendation

Avoid sending secrets or sensitive personal/business data unless you trust Scrapeless's handling, privacy, and retention practices.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Dependency behavior could vary over time depending on what versions are installed from the package index.

Why it was flagged

The dependency versions are lower-bound ranges rather than pinned exact versions, so future installs may resolve to newer package versions.

Skill content

requests>=2.31.0
python-dotenv>=1.0.0

Recommendation

Install in a virtual environment and consider pinning or locking dependency versions for repeatable, lower-risk installs.