Scraper Template

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:05 AM UTC
• Version: 1.0.0

Overview

This is a coherent API documentation scraper template, but its output writer can be steered outside the chosen folder by unsafe scraped module identifiers.

Review this skill before installing or adapting it. It appears intended for API documentation scraping, but users should sanitize module ids and module names, resolve output paths, and verify generated files stay under the selected output directory before scraping untrusted or externally controlled documentation sites.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/scrape_base.py:275

Finding

Path Traversal Through Unsanitized Module Identifier

Content

View full analysis

Vulnerability Details

File Location: scripts/scrape_base.py, lines 275–278
Vulnerability Type: Output path traversal
Risk Level: Medium

python

safe_name = mod["name"].replace("/", "-")
file_path = self.output_dir / f"{mid}_{safe_name}.json"
with open(file_path, "w", encoding="utf-8") as f:
    json.dump({

Technical Analysis

The module identifier mid is incorporated directly into a filesystem path without validation or sanitization. Although forward slashes in mod["name"] are replaced, the same protection is not applied to mid, and the resulting path is not resolved and checked against the configured output directory.

In subclasses that derive module identifiers from scraped website content, a malicious or compromised documentation site could supply an identifier containing traversal components such as ../. Python's path composition preserves these components, and open(..., "w") follows them when creating the output file.

Attack Path

1. An attacker controls or compromises an API documentation page processed by the scraper.
2. The platform-specific expand_menu() implementation copies a remote module identifier such as ../../target into the returned modules dictionary.
3. scrape() passes that dictionary to save_results().
4. save_results() combines the untrusted identifier with self.output_dir.
5. The operating system resolves the traversal components when open() is called.
6. The generated JSON is written outside the intended output directory.

Exploitation depends on a subclass propagating attacker-controlled page data into mid without prior validation.

Impact Assessment

An attacker could create or overwrite files reachable by the scraper process outside the configured output directory. The operation is limited to the filesystem permissions of the process account, and the written content is JSON generated from the scraped module ...[truncated 197 chars]

Remediation

View remediation

Remediation Suggestions

• Treat both mid and mod["name"] as untrusted input.
• Convert identifiers to filenames using a strict allowlist, such as ASCII letters, digits, underscores, and hyphens.
• Reject empty names and special path components such as . and ...
• Resolve the candidate output path and verify that it remains beneath the resolved output directory before opening it.
• Prefer locally generated stable identifiers instead of remote identifiers for filenames.
• Use exclusive file creation where overwriting existing files is unnecessary.

Example containment pattern:

python

safe_mid = re.sub(r"[^A-Za-z0-9_-]", "_", str(mid))
safe_name = re.sub(r"[^A-Za-z0-9_-]", "_", str(mod["name"]))

output_root = self.output_dir.resolve()
file_path = (output_root / f"{safe_mid}_{safe_name}.json").resolve()

if output_root not in file_path.parents:
    raise ValueError("Output path escapes the configured directory")

with open(file_path, "w", encoding="utf-8") as f:
    json.dump(data, f, ensure_ascii=False, indent=2)

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The top-level docstring presents all usage instructions and descriptions only in Chinese, which can constitute a language/locale policy issue when no opt-in or alternative language is offered. The file does not indicate that the skill is intentionally limited to a Chinese-only regional or compliance context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.