Anti-Bot Scraper

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:26 AM UTC
• Version: 1.0.0

Overview

This is a disclosed stealth web-scraping skill, but it gives broad browser, cookie, proxy, and install-time authority with limited guardrails.

Review before installing. Use this only for websites you are authorized to access, avoid passing account session cookies unless you understand that requests may act as you, use only trusted proxies, do not aim it at localhost/private-network/cloud metadata addresses, and install in a sandboxed environment with reviewed dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/scraper-stealth.js:432
• Finding: Unrestricted browser navigation permits access to private and local network resources## Vulnerability Details **File Location**: - `scripts/scraper-simple.js:82` - `scripts/scraper-stealth.js:432-441` - `scripts/scraper-stealth.js:461` - `scripts/scraper-batch.js:93-96` **Vulnerability Type**: Server-Side Request Forgery through unrestricted browser navigation **Risk Level**: Medium ### Vulnerable Code `scripts/scraper-simple.js:82`: ```js await page.goto(opts.url, { waitUntil: 'domcontentloaded', timeout: 30000 }); ``` `scripts/scraper-stealth.js:432-441`: ```js const context = await browser.newContext({ userAgent, viewport, locale: 'zh-CN', timezoneId: 'Asia/Shanghai', deviceScaleFactor: isMobile ? pick([2, 3]) : 1, isMobile, hasTouch: isMobile, javaScriptEnabled: true, ignoreHTTPSErrors: true, }); ``` `scripts/scraper-stealth.js:461`: ```js await page.goto(opts.url, { waitUntil: 'domcontentloaded', timeout: 60000 }); ``` `scripts/scraper-batch.js:93-96`: ```js const scriptName = opts.stealth ? 'scraper-stealth.js' : 'scraper-simple.js'; const scriptPath = path.join(__dirname, scriptName); const args = [scriptPath, url]; ``` ### Technical Analysis The scraper accepts user-provided URLs and passes them directly to Playwright without validating the URL scheme, hostname, embedded credentials, resolved IP address, or redirect destination. There are no controls preventing navigation to loopback, private, link-local, or cloud metadata addresses. Consequently, the browser may access services reachable from the execution host even when those services are not externally accessible. The page text, links, images, and metadata are then serialized into the scraper's JSON output. Redirects present an additional bypass because an initially public URL can redirect to a prohibited internal destination. Stealth mode further configures `ignoreHTTPSErrors: true`, disabling certificate validation for browser requests. This weakens transport security and a ...[truncated 1557 chars]
• Remediation: ## Remediation Suggestions 1. Parse every supplied URL with the standard `URL` class and permit only explicitly supported schemes, normally `https:` and optionally `http:`. 2. Reject URLs containing embedded usernames or passwords. 3. Resolve the destination hostname before navigation and reject all loopback, private, link-local, multicast, unspecified, carrier-grade NAT, and reserved IPv4 and IPv6 ranges. 4. Revalidate the destination after every redirect. Use Playwright request interception or navigation event handling to block requests whose resolved destination violates the network policy. 5. Protect against DNS rebinding by validating each connection destination rather than validating only the initial hostname. 6. Block known metadata addresses and hostnames explicitly, including link-local metadata endpoints used by supported cloud platforms. 7. Prefer an explicit hostname allowlist when the set of legitimate targets is known. 8. Remove `ignoreHTTPSErrors: true`, or expose it only as an explicit high-risk option that is disabled by default. 9. Apply outbound firewall or sandbox rules to the browser process so code-level validation is not the only protection. 10. Add tests covering direct private addresses, IPv6 loopback, decimal or encoded IP forms, redirects to private destinations, and DNS rebinding behavior.

T08 · Insecure Dependencies

Note

• Location: package-lock.json:32
• Finding: Dependency installation relies on a non-official package mirror and executes downloaded tooling## Vulnerability Details **File Location**: - `package-lock.json:16` - `package-lock.json:32` - `package-lock.json:47` - `package.json:7` - `scripts/setup.js:26-29` - `scripts/setup.js:54-57` **Vulnerability Type**: Third-party dependency and installation-chain trust exposure **Risk Level**: Low ### Vulnerable Code `package-lock.json:32-33`: ```json "node_modules/playwright": { "version": "1.58.2", "resolved": "https://registry.npmmirror.com/playwright/-/playwright-1.58.2.tgz", ``` The same non-official registry host is used for other locked packages, including `fsevents` and `playwright-core`. `package.json:6-8`: ```json "scripts": { "postinstall": "npx playwright install chromium", "setup": "node scripts/setup.js", ``` `scripts/setup.js:26-29`: ```js execSync('npm install', { cwd: path.join(__dirname, '..'), stdio: 'inherit', }); ``` `scripts/setup.js:54-57`: ```js execSync('npx playwright install chromium', { cwd: path.join(__dirname, '..'), stdio: 'inherit', }); ``` ### Technical Analysis The lockfile directs npm to retrieve dependencies from `registry.npmmirror.com` rather than the official npm registry. Installation then executes Playwright's command-line tooling and downloads a Chromium browser executable. Package integrity hashes provide meaningful protection against a mirror silently returning content different from the content recorded in the lockfile. They do not, however, remove the additional operational and provenance trust placed in the mirror, nor do they protect a future regenerated or maliciously modified lockfile. Browser binary acquisition also expands the installation trust boundary beyond the JavaScript package archive. The declared Playwright dependency uses the range `^1.52.0`, while the lockfile currently resolves it to `1.58.2`. Reproducibility therefore depends on consistently using the lockfile, preferably through `npm ci`. ...[truncated 1541 chars]
• Remediation: ## Remediation Suggestions 1. Regenerate the lockfile using the official npm registry at `https://registry.npmjs.org/`. 2. Pin Playwright to an exact reviewed version rather than a broad semver range. 3. Use `npm ci` in automated and production installations to enforce the checked-in lockfile. 4. Retain and verify package integrity hashes during installation. 5. Configure an approved internal artifact repository if direct use of the official registry is prohibited. 6. Pin and verify Playwright browser artifacts in controlled build environments. 7. Download browser binaries during a reviewed image-build stage instead of automatically on every installation. 8. Avoid redundant browser installation: both the `postinstall` script and `scripts/setup.js` currently invoke the Playwright installer. 9. Run package installation as an unprivileged account in a sandboxed build environment with restricted secrets and outbound access. 10. Add dependency review, lockfile-diff inspection, and vulnerability scanning to the release process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The description overstates the skill’s capabilities in material ways. While the code does perform webpage scraping using Playwright, it only supports a straightforward single-URL headless scraping workflow with optional wait time and CSS selector scoping. The advertised anti-censorship/anti-detection features and multiple operating modes are absent from the provided code. Because these are central to the declared purpose—not minor implementation details—this is a clear description-to-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: 整体上，代码与“反爬虫网页抓取、截图保存、反检测技术”这一核心描述基本一致，且实际实现的隐身能力较为充分。不过，声明中提到的“普通模式、隐身模式和批量模式”并未被代码完整覆盖。当前代码只接受单个 URL，围绕 stealth 抓取展开，没有普通/非隐身模式切换，也没有批量抓取能力。因此属于描述对支持模式的功能范围有明显夸大或不准确之处。其余能力如截图、HTML 保存、代理、Cookie、滚动抓取等属于抓取技能的合理扩展，不构成额外未声明的高风险偏差。

Ae1

High

• Category: analysis-evasion

Content

node scripts/scraper-batch.js [options] <URL1> <URL2> ...

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/scraper-batch.js [options] <URL1> <URL2> ...

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/scraper-batch.js [options] <URL1> <URL2> ...

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/scraper-batch.js [options] <URL1> <URL2> ...

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/scraper-batch.js [options] <URL1> <URL2> ...

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Overly broad trigger keywords can cause the skill to activate for generic scraping-related prompts outside a narrow intended scope. In this case, the skill is explicitly positioned for anti-bot bypass and stealth scraping, so broad matching increases the chance of unintended invocation of evasion-oriented functionality for questionable targets or workflows.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Documenting screenshot and HTML export without a prominent local-write warning can lead users to unintentionally store sensitive page contents on disk. In a scraping context, saved artifacts may include personal data, session-specific content, or copyrighted/internal material, increasing exposure if the filesystem is shared or insufficiently protected.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill supports proxy and cookie injection without clearly warning that user-supplied cookies and traffic may be sent to remote sites or third-party proxies. In a stealth-scraping context, this is more dangerous because users may paste active session cookies or route requests through untrusted infrastructure, risking account takeover, data leakage, or interception.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: The postinstall script invokes `npx playwright install chromium`, which can resolve and execute a package version at install time instead of a fully pinned local binary. That creates a supply-chain risk because installation behavior depends on external registry state, and the risk is amplified by automatic execution during `postinstall`, which runs without an explicit user review step.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The file's user-facing natural-language strings in the header comments are entirely in Chinese, including the usage/options descriptions. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This code performs an HTTP navigation to a user-supplied URL and then extracts page text, links, images, and metadata before printing the collected data. Although the file has a brief usage header, it does not clearly warn users that external network requests will be made and that potentially sensitive page content will be collected and emitted to stdout.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The injected script hard-codes navigator.languages to ['zh-CN', 'zh', 'en-US', 'en'] and navigator.language to 'zh-CN'. This is a natural-language/locale policy issue because it forces a specific locale rather than offering user opt-in or making the locale configurable.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The Playwright context sets locale: 'zh-CN' and timezoneId: 'Asia/Shanghai' unconditionally. This enforces a specific locale/region behavior without user choice or visible justification, matching the policy-violation category for language/locale constraints.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The file’s user-facing output and descriptive comment are written in Chinese throughout, including status, error, and guidance messages. This imposes a specific language on users without offering a language choice or documenting a justified region-specific constraint, which matches the locale policy violation criteria.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence
• Finding: The script invokes `npx playwright install chromium`, which can resolve and execute a package version at runtime if the local toolchain is missing or altered. That creates a supply-chain risk and undermines reproducibility, especially in setup code that users are likely to run with broad local privileges. In the context of a stealth scraping skill, this is somewhat more concerning because the package’s purpose already centers on evasion and browser automation, increasing the risk tolerance of operators and the attractiveness of tampering.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence
• Finding: The fallback instruction tells users to run `npx playwright install chromium` manually without an exact version, which can fetch or execute an unexpected package version at install time. Even though this is only a printed command, it still guides users toward unsafe, non-reproducible dependency execution and can expose them to supply-chain compromise. Given the stealth-scraper context, users may already be operating in lower-trust environments or against anti-bot targets, making compromised tooling more dangerous.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 79% confidence
• Finding: The message recommending `npx playwright install-deps chromium` again relies on an unpinned runtime command path, with the same risk of executing a different package version than the one reviewed. Although it appears in an error hint rather than direct execution, it still propagates insecure installation practice and can lead users to run privileged setup steps from an unpinned source. Because `install-deps` may involve elevated system changes, compromise here can have broader host impact.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: The manifest description and trigger phrasing are primarily Chinese-language, which can impose a language expectation on users without stating that the skill is Chinese-only or offering alternatives. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy issue.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"batch": "node scripts/scraper-batch.js"
  },
  "dependencies": {
    "playwright": "^1.52.0"
  }
}

• Confidence: 74% confidence
• Finding: Using `^1.52.0` allows automatic adoption of newer compatible releases, which can introduce unreviewed code changes into a scraping tool that already has elevated abuse potential. While common in development, this weakens reproducibility and increases supply-chain exposure if a future dependency release is compromised or introduces risky behavior.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The top-level descriptive comment presents the script description in Chinese only, which indicates a fixed locale for user-facing skill documentation. There is no accompanying language choice, opt-in, or justification that the skill is intentionally region-specific.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/scraper-batch.js:101

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/setup.js:27