Crawl Pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:10 AM UTC
• Version: 1.0.0

Overview

This scraping skill is not malicious, but it teaches anti-bot bypass, proxy rotation, and scaled collection without clear authorization or compliance guardrails.

Install and use this only for sites you own or are authorized to crawl. Pin and review the Scrapling dependency in an isolated environment, avoid privileged installs, and add your own limits for robots.txt, terms, rate limiting, privacy, and data retention before using anti-bot or proxy features.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:48

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 48-49
Vulnerability Type: Unverified and unpinned third-party package installation
Risk Level: Medium

text

### 安装
pip install scrapling

Technical Analysis

The Skill instructs the user or Agent to install scrapling from the configured Python package index without specifying a reviewed version, validating cryptographic hashes, using a lockfile, or identifying a trusted package source. Consequently, package resolution is mutable and may select a release or transitive dependency that did not exist when the Skill was audited.

Python package installation can execute package build hooks and other installation-time code. If the selected package, one of its transitive dependencies, or the configured package index is compromised, malicious code could run with the privileges of the account executing pip.

The network access used by the crawling examples is consistent with the Skill's declared functionality. The audited file does not instruct the Agent to collect or transmit credentials, private keys, environment variables, local files, or Agent memory. The security issue is therefore limited to the dependency installation process rather than confirmed sensitive-data exfiltration.

Attack Path

1. A user or Agent follows the installation instruction in SKILL.md.
2. pip queries the configured package index and resolves the latest compatible scrapling release and its transitive dependencies.
3. An attacker compromises a future package release, a transitive dependency, its publishing account, or the package-index resolution path.
4. Because no trusted version or hash is enforced, pip accepts the attacker-controlled distribution.
5. Malicious installation or runtime code executes under the identity of the user running the command.
6. That code can access resources available to that user and may establish outbound connections, alter user-owned ...[truncated 790 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin scrapling to a specifically reviewed version rather than installing the latest available release:

   text

   pip install scrapling==<reviewed-version>
   

2. Generate and maintain a dependency lockfile that also pins all transitive dependencies.
3. Record and enforce cryptographic hashes for every downloaded distribution, such as through a requirements file used with pip install --require-hashes.
4. Explicitly use a trusted package index and prevent unintended fallback to untrusted or privately controlled indexes.
5. Install the package inside a dedicated virtual environment or container with no unnecessary credentials, filesystem access, or elevated privileges.
6. Review package provenance, maintainers, release signatures where available, and dependency changes before updating the pinned version.
7. Add an automated dependency-scanning and update-review process so security fixes can be adopted without silently accepting arbitrary future releases.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill provides operational guidance for anti-bot bypass, proxy rotation, concurrent crawling, and data export but omits any warning or constraint around authorization, legality, privacy, or service impact. That omission is dangerous because it normalizes potentially abusive collection behavior and lowers friction for misuse against third-party sites, especially with Cloudflare bypass and scaling features explicitly advertised.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are broad enough to activate on ordinary scraping-related requests, which can cause the agent to enter a high-risk workflow without clear user intent. In this skill, that matters more because the workflow includes anti-bot bypass, proxy rotation, and scalable crawling, so accidental invocation could lead to policy-violating or harmful guidance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The description and keywords are primarily Chinese, and the trigger section later relies on Chinese phrases as primary activation cues. There is no indication that the skill offers multilingual use or that the Chinese-only presentation is a documented, justified locale constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.