Scrapeless Scraping Browser Skill

• Outcome: Review
• Latest audit: Sep 15, 2026 · 2:05 AM UTC
• Version: 1.0.0

Overview

This appears to be a real Scrapeless cloud-browser automation skill, but it needs Review because it combines broad remote browsing, proxy/anti-detection, cookies/storage, recording, and unpinned package execution with incomplete scoping and credential warnings.

Install only if you intend to use Scrapeless as a third-party cloud browser and are comfortable sending browsing workflows through that service. Prefer a pinned, reviewed package version, use narrowly scoped API tokens, avoid entering real passwords or proxy credentials directly on the command line, do not enable recording or live preview for sensitive accounts unless necessary, and confirm site authorization before using proxy or anti-detection features.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:4

Finding

Unpinned and Inconsistently Named npm Packages Create a Supply-Chain Execution Risk

Content

View full analysis

=18.0.0" }, "installation": { "npm": "npm install -g scrapeless-scraping-browser" } ``` ### Technical Analysis The skill authorizes execution through `npx` without pinning a package version or package integrity hash. Depending on the local npm cache and `npx` behavior, invoking an unavailable package can retrieve its current release from the configured npm registry and execute its package entry point. Consequently, the code executed at invocation time can differ from the code that was reviewed. The package identity is also inconsistent: - `SKILL.md` authorizes or updates `scrapeless-scraping-browser-skills`. - `skill.json` authorizes and installs `scrapeless-scraping-browser`. This inconsistency makes it unclear which package is authoritative and increases the chance of installing or executing the wrong package. If one name is obsolete, unintended, abandoned, or later acquired by another publisher, it can become a dependency-confusion or package-takeover vector. No lockfile, exact version, resolved artifact, or integrity digest is present in the audited project to bind execution to a reviewed release. ### Attack Path 1. An attacker compromises the publisher account or obtains control of one of the inconsistently referenced npm package names. 2. The a ...[truncated 1313 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:39

Finding

Authentication and Proxy Credentials Are Passed Through Observable Command-Line Arguments and Stored in Plaintext Configuration

Content

View full analysis

Environment variable (only `SCRAPELESS_API_KEY` supports env var) Available configuration options: - `apiKey` - Your Scrapeless API token (required) - `apiVersion` - API version (v1 or v2, default: v2) - `sessionTtl` - Session timeout in seconds - `sessionName` - Session name for identification - `sessionRecording` - Enable session recording (true/false) - `proxyUrl` - Custom proxy URL ``` `references/authentication.md:7-13`: ```bash ### Method 1: Config File (Recommended) ```bash scrapeless-scraping-browser config set apiKey your_api_key_here ``` This stores the key securely in `~/.scrapeless/config.json` with restricted permissions (0600). ``` `references/authentication.md:32-37`: ```bash ## Verify Authentication ```bash # Check if API key ...[truncated 2853 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill extensively documents cloud browsing, cookies, localStorage access, screenshots, recording, live preview, and remote sessions, but does not prominently warn that sensitive credentials, page contents, and session artifacts may be transmitted to and stored on third-party infrastructure. In this context, omission of these warnings materially increases the risk of unintentional data exposure during normal use.

Content

No source excerpt is available for this finding.

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 622)May include surrounding context.

Debugging

Enable debug mode for detailed logs:

bash

scrapeless-scraping-browser config set debug true

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The manifest references npx scrapeless-scraping-browser-skills without an exact version, exposing users to unreviewed upstream changes at runtime. Because this skill is designed to be invoked by agents automatically, unpinned package execution increases the chance of remote code execution via package compromise or typosquatting-like replacement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are extremely broad and include common browsing tasks like opening websites, clicking buttons, taking screenshots, and scraping data. In an agent ecosystem, broad triggers can cause this cloud-browser skill to activate for ordinary requests, unexpectedly sending user browsing activity and page contents to a remote third-party service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description explicitly promotes 'bypass detection' and anti-detection features without any justification, restrictions, or consent guardrails. This increases the likelihood that the skill is used for stealthy scraping or policy-evasive automation and encourages behavior that may violate site security expectations or enable abuse.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The skill allows execution of an NPX package without a pinned version, which means future installs may resolve to a different package version than the author reviewed. In an agent setting, this creates a supply-chain risk where a compromised or malicious package update could execute arbitrary code with the agent's privileges.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation states that sessions will be automatically reused if --session-id is omitted, while other sections say sessions terminate when the connection closes and cannot be reconnected. For a cloud browser handling authentication, cookies, and live sessions, contradictory guidance can cause operators to unintentionally act in the wrong session or assume a session is isolated when it is not.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The session-persistence guidance is inconsistent and can mislead users about whether authenticated state survives across operations. In a remote browser that exposes cookies, storage, recording, and live preview, confusion about persistence can result in accidental credential reuse, stale-session assumptions, or actions being taken in unintended authenticated contexts.

Content

Scanner excerpt · SKILL.md (reported line 329)May include surrounding context.

bash

scrapeless-scraping-browser config set apiKey your_token

# Create a session for login
scrapeless-scraping-browser create --name "login-session" --ttl 1800
scrapeless-scraping-browser open https://app.example.com/login
scrapeless-scraping-browser snapshot -i

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 710)May include surrounding context.

md

## Support

- Documentation: https://docs.scrapeless.com
- API Reference: https://api.scrapeless.com/docs
- GitHub Issues: https://github.com/scrapeless-ai/scraping-browser-skill/issues

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description and triggers advertise sensitive capabilities like residential proxies and anti-detection features without warning about legal, privacy, consent, or account-safety implications. In context, this makes the skill more dangerous because it is designed for powerful web interaction that can affect third-party services, user accounts, and potentially bypass site defenses without prompting additional caution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list is broad and overlaps with many normal browsing or web-help requests, increasing the chance that the skill is invoked when the user did not clearly request this specific high-risk capability. Because the skill enables browser automation, scraping, proxy usage, and anti-detection behavior, accidental invocation could cause unintended actions against third-party sites or exposure of sensitive session data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill permits execution of an external package via npx using an unpinned package reference, which allows whatever version is current at invocation time to be fetched and run. That creates a supply-chain risk: a compromised upstream package, malicious new release, or typo/package takeover could lead to arbitrary code execution in the agent environment.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The command reference defines session creation as 'new-session', but later sections repeatedly instruct users to run 'create' for the same purpose. Because these are presented as authoritative usage instructions for the same CLI behavior, they contradict each other and obscure the actual intended command surface.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.