ClawHub
Back to skill

Security audit

Scrapfly CLI

Security checks for vulnerabilities and agentic risk

Overview

This Scrapfly CLI skill is not clearly malicious, but it needs Review because it combines persistent browser sessions, recurring webhook delivery, credential handling, and mutable installs without enough scoping guidance.

Review this skill before installing if you will use real accounts, authenticated browser sessions, webhooks, or the BYOP connector. Prefer a pinned and verified Scrapfly CLI release, keep API keys out of prompts and logs, isolate browser sessions per task, close sessions when done, and only configure schedules or webhooks to destinations you control.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:27
Finding

Unpinned Installation of a Mutable External CLI

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:27-31
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet

bash
Pre-built binaries (macOS universal, Linux amd64/arm64, Windows amd64) on
the [Releases page](https://github.com/scrapfly/scrapfly-cli/releases). Or
from source:

go install github.com/scrapfly/scrapfly-cli/cmd/scrapfly@latest

Technical Analysis

The installation command retrieves and executes the latest available version of an external Go package without pinning a reviewed release or commit. The effective implementation can therefore change after this Skill has been audited.

Although the GitHub repository appears consistent with the declared Scrapfly functionality, the use of @latest removes reproducibility and creates a supply-chain trust dependency on the repository, its maintainers, the Go module infrastructure, and future releases. An upstream compromise or malicious release could cause arbitrary code to execute during installation or when the installed CLI is subsequently invoked.

This is not evidence that the current upstream package is malicious. The vulnerability is the mutable, unverified dependency acquisition process.

Attack Path

  1. An attacker compromises the upstream repository, maintainer account, release process, or dependency chain.
  2. The attacker publishes a malicious version that resolves as latest.
  3. An agent or user follows the Skill and runs the documented go install ...@latest command.
  4. The malicious package is compiled and installed locally.
  5. When the resulting scrapfly binary is invoked, attacker-controlled code executes with the permissions of the installing user.
  6. That code could access files, environment variables, locally stored Scrapfly credentials, and any other resources available to the user account.

Impact Assessment

Successful exploitation could provide arbitrary code exec ...[truncated 606 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace @latest with a specific reviewed semantic version or immutable commit hash, for example:

    bash
    go install github.com/scrapfly/scrapfly-cli/cmd/scrapfly@vX.Y.Z

  • Publish expected SHA-256 checksums for pre-built binaries and require verification before execution.

  • Prefer cryptographically signed releases and document signature verification.

  • Review dependency changes before updating the pinned version.

  • Run the CLI as an unprivileged user and restrict its access to unrelated files and credentials.

  • Avoid automated installation when an approved, previously verified binary is already available.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:117
Finding

Scrapfly API Key Transmitted in an HTTPS Query String

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:117-121
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code Snippet

text
Path F (REST API only): skip the CLI, call
https://api.scrapfly.io/{scrape,screenshot,extraction,crawl} directly
with ?key=<API_KEY>. Official SDKs: Python, TypeScript, Go, Rust. See
[docs.scrapfly.io](https://scrapfly.io/docs).

Technical Analysis

The Skill recommends placing a Scrapfly API key in the URL query string. HTTPS protects the URL while it is in transit between properly configured endpoints, but query strings are commonly retained outside the encrypted transport channel after processing.

Credential-bearing URLs may be recorded in shell history, command-line process information, application logs, reverse-proxy logs, observability platforms, debugging output, exception reports, or copied links. Query parameters may also be retained by intermediaries and monitoring systems that log complete request URLs.

The key is intentionally sent to Scrapfly as part of the declared cloud functionality; therefore, this is not covert exfiltration. The security concern is the unsafe credential transport format and the increased probability of secondary disclosure.

Attack Path

  1. A user or agent constructs a request containing ?key=<API_KEY>.
  2. The complete URL is recorded by shell history, application logging, proxy telemetry, monitoring infrastructure, or debugging tools.
  3. An attacker obtains read access to one of those records.
  4. The attacker extracts the API key from the logged URL.
  5. The attacker submits authenticated requests to Scrapfly using the exposed key.
  6. The attacker consumes account resources or accesses functionality authorized to that key until it is revoked or expires.

Impact Assessment

The attacker may obtain the Scrapfly account permissions associated with the leaked API key. Dep ...[truncated 472 chars]

Remediation
View remediation

Remediation Suggestions

  • Prefer an HTTP authorization header rather than a query parameter, such as an officially supported bearer-token or API-key header.
  • Use official SDK or CLI authentication facilities that avoid exposing credentials in command arguments and URLs.
  • If query-string authentication is unavoidable, use short-lived, narrowly scoped tokens rather than long-lived account keys.
  • Configure clients, proxies, servers, and observability systems to redact key and other authentication parameters.
  • Prevent credential-bearing commands from being persisted in shell history.
  • Rotate any key that may already have appeared in logs and review account usage for unauthorized activity.
  • Document the credential exposure risk directly beside the REST example.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:335
Finding

Browser Authentication Credential Embedded in a WebSocket URL

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:335-341
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code Snippet

text
| Product | Endpoint | CLI |
|---|---|---|
| Web Scraping | GET/POST /scrape | scrapfly scrape <url> |
| Screenshot | POST /screenshot | scrapfly screenshot <url> |
| Extraction | POST /extraction | scrapfly extract |
| Crawler | POST /crawl + /crawl/{uuid}/{status,urls,contents,artifact} | scrapfly crawl {start,run,status,urls,contents,cancel,artifact} |
| Browser (CDP) | wss://browser.scrapfly.io?api_key=... | scrapfly browser |

Technical Analysis

The browser endpoint format places authentication data in the WebSocket URL. WSS encrypts transport traffic, but the complete connection URL can still be exposed through local process arguments, client diagnostics, WebSocket connection logs, proxy telemetry, crash reports, or copied configuration.

CDP endpoints are especially sensitive because possession of a valid authenticated endpoint may permit remote browser control within the session and account constraints. The endpoint is part of the Skill's declared remote-browser functionality, so sending authentication to the official browser service is necessary. Embedding the credential directly in a reusable URL nevertheless increases exposure beyond minimum secure practice.

Attack Path

  1. A user or agent obtains or constructs a WebSocket URL containing the API key.
  2. The URL is passed to a browser automation client or stored in a variable, log, command argument, configuration file, or diagnostic report.
  3. An attacker gains access to that location and extracts the key or complete endpoint.
  4. The attacker attempts to authenticate to the Scrapfly browser service.
  5. If the credential remains valid and authorization permits it, the attacker creates or accesses remote-browser functionality under the victim's account ...[truncated 805 chars]
Remediation
View remediation

Remediation Suggestions

  • Prefer an authenticated connection bootstrap that exchanges the long-lived API key for a short-lived, single-session WebSocket token.
  • Avoid exposing long-lived account credentials in CDP URLs.
  • Redact api_key query parameters from browser-client logs, proxy logs, diagnostics, and error reporting.
  • Do not print complete authenticated WebSocket URLs to shared terminals or persistent logs.
  • Store temporary connection details in access-controlled memory or files and delete them promptly after use.
  • Enforce short expiration periods, narrow scopes, and immediate server-side revocation for browser tokens.
  • Rotate credentials suspected of having been included in logs or shared configuration.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest frames the skill as a Scrapfly CLI wrapper for scraping, screenshots, extraction, crawling, and browser driving. The body of the skill also documents materially broader capabilities including account/auth management, alert creation and deletion, recurring job scheduling, extension management, and installing/running an exit-peer connector, which go beyond the manifest's described scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrase any task involving the scrapfly command is excessively broad and can cause the skill to be selected for loosely related requests, including sensitive browsing, anti-bot bypass, or external transmissions the user did not clearly intend. In an agent ecosystem, overbroad routing increases the chance of surprising tool execution and unsafe data handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The browser daemon section states that cookies, tabs, and AXTree refs persist across calls, but it does not prominently warn that authenticated session state may survive between tasks and be reused unintentionally. In a shared or long-lived agent environment, this can expose prior-login state, enable cross-task data access, and blur security boundaries between users or workflows.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md
budget small.

**Path F (REST API only):** skip the CLI, call
`https://api.scrapfly.io/{scrape,screenshot,extraction,crawl}` directly
with `?key=<API_KEY>`. Official SDKs: Python, TypeScript, Go, Rust. See
[docs.scrapfly.io](https://scrapfly.io/docs).

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The scheduling and webhook features allow scraped or crawl results to be delivered to external endpoints, yet the skill lacks strong warnings that this can transmit sensitive content off-platform. In agent-driven usage, a user may not realize that enabling a webhook creates ongoing external exfiltration of collected data beyond the immediate CLI invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The authentication section documents persistent credential storage in environment variables and ~/.scrapfly/config.json without prominent warnings about secret handling, shell history exposure, multi-user systems, or accidental disclosure in logs. Because this skill is intended for agent use, unclear credential hygiene materially raises the risk of API key leakage and unauthorized account usage.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest states 'JSON envelope on stdout for every command,' which implies universal structured output. However, the skill documentation explicitly says --proxified streams the raw upstream body with no JSON envelope and browser content --raw prints HTML directly to stdout, so the stated output contract is not universally true.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.