Scrapfly Extraction

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:08 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Scrapfly API usage guide; it sends chosen content to Scrapfly as expected, with privacy and dependency cautions for users.

Install in a virtual environment and consider pinning `scrapfly-sdk` to a reviewed version. Treat anything passed as `body` or scraped and extracted through this skill as data sent to Scrapfly, so redact secrets, personal data, regulated data, and confidential documents unless that use is approved.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Unpinned Third-Party Python Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 21
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash

pip install scrapfly-sdk

Technical Analysis

The installation instruction retrieves scrapfly-sdk without pinning a reviewed version or verifying package integrity. As a result, the package version installed depends on the state of the configured Python package index at installation time. Its transitive dependencies are likewise unconstrained.

Python packages and their build dependencies can execute package-controlled code during installation or when imported. If the upstream package, publishing account, package index, or a transitive dependency is compromised, following this instruction could install and execute attacker-controlled code. The reviewed Skill contains no evidence that the named package is currently malicious; the vulnerability is the absence of version and integrity controls.

Attack Path

1. An attacker compromises the scrapfly-sdk publishing account, an upstream dependency, or the package index used by the victim.
2. The attacker publishes a malicious release that satisfies the unconstrained package request.
3. A user or agent follows the instruction in SKILL.md and runs pip install scrapfly-sdk.
4. pip resolves and downloads the attacker-controlled package or dependency.
5. Malicious code executes during installation, import, or subsequent SDK use with the privileges of the user running Python.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the installing user's privileges. Depending on that user's access, an attacker could read or modify accessible files, steal environment variables such as SCRAPFLY_API_KEY, alter the Python environment, access network resources, or affect other processes and data available to the account. This instruction does not itself request elevated privileges, so th ...[truncated 125 chars]

Remediation

View remediation

Remediation Suggestions

• Pin scrapfly-sdk to a specifically reviewed version, for example:

  bash

  pip install "scrapfly-sdk==<reviewed-version>"
  

• Maintain a lock file that pins all transitive dependencies.
• Generate and verify cryptographic hashes, and install with pip --require-hashes.
• Explicitly use a trusted package index rather than relying on uncontrolled local index configuration.
• Install the dependency in an isolated virtual environment under a non-privileged account.
• Review new package and dependency versions before updating the pin.
• Use automated dependency scanning and monitor upstream security advisories.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs users to send page or document content to Scrapfly's remote Extraction API, but it does not clearly warn that the content is transmitted to a third-party service for processing. This creates a genuine privacy and data-handling risk because users may submit sensitive internal documents, credentials, personal data, or proprietary web content without understanding the external exposure.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The documented endpoint shows that extracted content is posted to an external network service, which is a real external transmission behavior. In this skill's context, the transmission is expected functionality rather than overtly malicious, but it is still security-relevant because the payload may contain sensitive scraped or user-provided content that leaves the local trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

## API Reference

**Endpoint:** `POST https://api.scrapfly.io/extraction`

### ScrapflyClient

Static analysis

No suspicious patterns detected.