Scrapfly Crawler

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:59 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Scrapfly crawler guide whose network use, API key use, and local output examples fit its stated purpose.

Install this only if you intend to use Scrapfly as a third-party crawling service. Review crawl limits, external-link settings, robots.txt handling, and saved archive paths before running on sensitive, private, or large sites; use a dedicated environment and consider pinning the SDK version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–18
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Vulnerable Code

bash

pip install scrapfly-sdk

Technical Analysis

The setup instructions install scrapfly-sdk without specifying a reviewed version or verifying an integrity hash. Consequently, installation behavior depends on whichever package release the configured Python package index resolves at execution time.

If the legitimate package, its publisher account, or the configured package index is compromised, a malicious future release could execute attacker-controlled code during installation, import, or normal SDK use. The absence of version pinning also makes deployments non-reproducible and permits unexpected compatibility or security regressions.

This finding is limited to an insecure dependency-management practice. The audited file does not itself contain an embedded malicious payload.

Attack Path

1. An attacker compromises the upstream package, its publisher account, or a package index trusted by the victim's pip configuration.
2. The attacker publishes or serves a malicious release of scrapfly-sdk.
3. A user follows the documented setup command without a pinned version or hash.
4. pip resolves and installs the attacker-controlled package.
5. Malicious code executes during installation, import, or subsequent SDK operations with the privileges of the user running the command.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The accessible scope could include that user's files, environment variables—including SCRAPFLY_API_KEY—network access, and any other resources available to the current process.

The instructions do not request elevated privileges, so administrative or root access is not directly established. Greater impact would require the user to run the installation in an elevated context or f ...[truncated 55 chars]

Remediation

View remediation

Remediation Suggestions

• Pin scrapfly-sdk to a specifically reviewed version.
• Record dependencies in a lock file or requirements file with SHA-256 hashes.
• Install with hash enforcement, for example:

bash

pip install --require-hashes -r requirements.txt

• Perform installation inside a dedicated virtual environment rather than a system-wide or privileged environment.
• Obtain packages only from an explicitly configured, trusted index.
• Review and test dependency updates before changing the pinned version.
• Add automated dependency vulnerability and integrity checks to the maintenance workflow.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file describes sending crawl jobs and retrieved page content through the Scrapfly API, including optional webhook events and following external links, but it does not clearly warn users that target URLs and crawled content are transmitted to a third-party service. Because the skill affects privacy and network exposure beyond the local machine, a user-facing disclosure is warranted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file demonstrates file-writing behavior via artifact.save('crawl_results.warc.gz') and later artifact.save('crawl_results.har') and open("llms-full.txt", "w"), but the surrounding documentation does not warn that these actions persist scraped site data locally. For a skill that can collect bulk website content, omission of a disclosure about local data storage could affect user data handling and system storage expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.