Security audit

ScraperAPI MCP

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent ScraperAPI MCP guidance skill, with disclosed scraping, search, crawling, and API-key requirements, but users should handle its external-service and setup risks carefully.

Install only if you intend to route scraping/search/crawler tasks through ScraperAPI and are comfortable providing a ScraperAPI API key. Prefer pinned, reviewed versions of the MCP helper packages, rotate the API key if it may have appeared in process logs, set crawl budgets and narrow URL patterns, and avoid callback URLs unless you control the HTTPS endpoint and approve sending crawl results there.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: references/setup.md:15
Finding: Unpinned Third-Party Packages Can Execute Unreviewed Code
Content: View full analysis
Remediation: View remediation
` for pip. 2. Commit lockfiles for any locally managed npm or Python environment. 3. Verify package integrity using registry checksums, pip hash checking, signed artifacts, or an internal artifact repository. 4. Install the verified npm dependency separately and start it with `npx --no-install` or an equivalent command that cannot fetch a new package at runtime. 5. Pin and audit transitive dependencies where feasible. 6. Document a controlled dependency-update process that includes source review, vulnerability scanning, and regression testing. 7. Run the MCP server under a restricted account or sandbox with access only to the files, environment variables, and network destinations required for its function. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: references/setup.md:16
Finding: ScraperAPI Bearer Token Is Passed Through the Process Argument Vector
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list is very broad and includes generic phrases such as finding information online, market research, competitive intelligence, and when unsure which ScraperAPI tool to use. This can cause the skill to activate in situations where simpler or safer built-in tools would be more appropriate, increasing the chance of unnecessary external data access, unexpected API usage, and inadvertent scraping of third-party sites.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file describes extracting agent names, brokers, and phone numbers as part of the tool output, but it does not include any warning or usage note about handling personal contact information. Under the markdown-specific SQP-2 criteria, descriptions should warn when behavior could affect privacy, especially where personally identifiable contact data is returned.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The document explicitly advises extracting URLs from search results to scrape full content, which can lead to collection or transmission of webpage data, but it does not include any user-facing warning about privacy, permissions, or site terms. Under the markdown-file criteria, guidance that can affect user data or external content access should disclose those implications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The guide tells users to combine Google News results with scraping to read full articles, but gives no caution that this behavior may access, store, or process third-party content and related metadata. For markdown documentation, potentially privacy- or integrity-affecting behaviors should be accompanied by a warning.
Content: No source excerpt is available for this finding.

Rp1

Low

Category: MCP Rug Pull
Confidence: 60% confidence
Finding: pip install without ==version installs the latest release, which could include malicious changes.
Content: No source excerpt is available for this finding.