Scrapfly Scraper

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:02 AM UTC
• Version: 1.0.0

Overview

This is a coherent Scrapfly scraping guide, but it encourages anti-bot bypass, proxy use, session reuse, and credential-like request forwarding without clear authorization or privacy guardrails.

Review before installing. Use this only for scraping you are authorized to perform, avoid sending private cookies, tokens, personal data, or confidential request bodies through the Scrapfly API, and install the SDK in an isolated environment with a pinned version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19-23
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code:

markdown

## Setup

```bash
pip install scrapfly-sdk

text

### Technical Analysis

The setup instructions install `scrapfly-sdk` without specifying a reviewed version or verifying the package with an integrity hash. No dependency lockfile, hash manifest, vendored source, or package-index restriction is provided elsewhere in the reviewed project.

Because Python package installation can execute package-controlled build or installation logic, the effective code installed by this command may change after the skill has been audited. A compromised or unexpectedly modified package release could therefore execute arbitrary code during installation or later when the SDK is imported.

This is a supply-chain weakness rather than evidence that the current `scrapfly-sdk` package is malicious.

### Attack Path

1. An attacker compromises the package publisher account, distribution infrastructure, or a future package release.
2. A user follows the documented setup command without a version constraint.
3. `pip` resolves and downloads the attacker-controlled release available at installation time.
4. Malicious package build or installation logic executes with the privileges of the user running `pip`.
5. Malicious runtime code may subsequently execute when the SDK is imported and may access process data, including `SCRAPFLY_API_KEY`.

### Impact Assessment

Successful exploitation could allow arbitrary code execution with the privileges of the installing user. The affected scope may include files and credentials accessible to that account, environment variables, network resources available to the host, and the Scrapfly API key supplied during normal operation.

The weakness does not independently grant administrator or root privileges. Its practical impact depen
...[truncated 128 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin scrapfly-sdk to a specifically reviewed version rather than installing the latest available release:

   bash

   python -m pip install "scrapfly-sdk==<reviewed-version>"
   

2. Generate and maintain a dependency lockfile containing exact transitive dependency versions.
3. Require package hashes, such as through a hash-locked requirements file and pip install --require-hashes.
4. Explicitly use a trusted package index and prevent unintended fallback to untrusted or private indexes.
5. Verify package provenance, release signatures where available, and publisher ownership before updating the pinned version.
6. Test dependency updates in an isolated environment and perform security review before deployment.
7. Instruct users to install the package inside a dedicated virtual environment under a non-privileged account.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly promotes anti-bot bypass, proxy rotation, geo-targeting, session reuse, and browser automation without any warning about legal, privacy, authorization, or target-system impact constraints. In a reusable agent skill, this lowers safety guardrails and can facilitate unauthorized scraping, evasion of access controls, or collection of protected content at scale.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

## API Reference

**Endpoint:** `https://api.scrapfly.io/scrape`
The HTTP method is forwarded to the upstream URL.
To retrieve data from a web page or an API, use the GET method, which is the default method.
If the API resource like an API requries other methods, like POST. You can use it via the `method` parameter of the `ScrapeConfig`

Static analysis

No suspicious patterns detected.