网页抓取工具免费版

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:28 AM UTC
• Version: 1.0.1

Overview

This is an instruction-only web scraping skill with expected network, file output, and Python setup behavior, but users should review its broad dependency installation and inconsistent documentation before use.

Install and run this only in an isolated environment, preferably a virtual environment or disposable container. Review the resolved Scrapling/httpx versions before installing, avoid scraping private or sensitive internal URLs unless you intend to expose request metadata to that server, and treat the skill as a single-page scraping helper rather than a general data analysis or reporting tool.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:195

Finding

Unpinned Third-Party Dependencies and Browser Components

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 195–202 and 258–267
Vulnerability Type: Uncontrolled third-party dependency installation
Risk Level: Medium

Vulnerable Code

Lines 195–202:

bash

# Install Scrapling and all optional dependencies
pip install "scrapling[all]"
scrapling install
# ...
# Install httpx (HTTP client)
pip install httpx

Lines 258–267:

bash

# Full installation (recommended, including browser engine)
pip install "scrapling[all]"
scrapling install
# ...
# Minimal installation (core parsing functionality only)
pip install scrapling
# ...
# Verify installation
python -c "import scrapling; print(scrapling.__version__)"

Technical Analysis

The Skill instructs the Agent to install scrapling, all of its optional dependencies, httpx, and browser components without pinning reviewed versions or validating package hashes. No lockfile, integrity metadata, trusted package index, or artifact verification procedure is provided.

Python package installation may execute package-controlled build logic. Installing the [all] extra also increases the number of transitive packages exposed to supply-chain compromise. The separate scrapling install command retrieves additional browser-related artifacts whose versions and integrity are not constrained by the Skill.

This creates a supply-chain risk if a future package release, transitive dependency, configured package index, or downloaded browser artifact is compromised. The audit did not find evidence that the currently named packages are malicious; the vulnerability is the uncontrolled installation process.

Attack Path

1. A user requests the Skill's web-scraping functionality.
2. The Agent follows the setup instructions in SKILL.md.
3. The Agent runs the unpinned pip install and scrapling install commands.
4. The package manager resolves whatever versions are currently available f ...[truncated 1050 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a reviewed exact version rather than allowing unconstrained resolution.
2. Generate and commit a lockfile that records resolved transitive dependency versions.
3. Require package hashes, such as with pip install --require-hashes -r requirements.txt.
4. Install only the Scrapling extras strictly required by the advertised non-JavaScript scraping behavior; avoid [all] unless every component is necessary.
5. Pin and verify browser component versions and checksums before installation.
6. Use an explicitly configured, trusted package index or an internally mirrored repository containing reviewed artifacts.
7. Perform installation inside an isolated virtual environment or disposable container under a non-privileged account.
8. Separate dependency installation from normal Skill invocation so users can review and approve the resolved artifacts.
9. Add automated dependency scanning and periodically review locked versions for known vulnerabilities.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill performs outbound web requests but does not present a clear warning that using it will contact third-party URLs and potentially transmit request metadata such as IP, headers, and timing. In this context, the risk is elevated because the skill is specifically designed for arbitrary URL fetching and could be invoked against attacker-controlled domains, creating privacy, compliance, or internal-network access concerns if not clearly bounded.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

L094-L099 明确把 JSON/CSV 结构化输出列为免费版不支持能力，但这些段落及相邻限制说明中又写明“返回结构化响应”且“支持创建/查询/导出操作”。这不是单纯信息不完整，而是对该 skill 输出能力的主动矛盾描述，会误导使用者对实际能力边界的理解。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Manifest 与主体说明多次强调该 skill 是网页抓取、CSS 选择器提取和文件保存工具，但 L188-L190 的触发条件改为数据分析、报表、统计与可视化场景，这些并非该技能声明或示例中实际覆盖的核心能力。该描述会让代理在错误上下文中调用技能，属于 manifest 级别的用途错配。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

L188-L190 将触发条件写成“需要数据分析、报表生成、统计洞察、数据可视化时使用”，这些表述覆盖大量通用办公与分析场景，而该技能实际能力仅限网页抓取与CSS选择器提取。描述没有给出明确触发短语、边界条件或反例，容易让代理在与网页抓取无关的普通分析请求中错误调用该技能。

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill performs outbound web requests but does not present a clear warning that using it will contact third-party URLs and potentially transmit request metadata such as IP, headers, and timing. In this context, the risk is elevated because the skill is specifically designed for arbitrary URL fetching and could be invoked against attacker-controlled domains, creating privacy, compliance, or internal-network access concerns if not clearly bounded.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

L073-L078 将能力严格限定为单 URL 抓取，但 L121 又定义了 callback_url 异步回调接口，L071-L072、L078 等还复用“创建/查询/导出”式通用操作描述，与一个简单同步单页抓取工具的文档定位不一致。虽然这里未看到可执行代码，但文档层面的意图说明已出现自相矛盾。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.