通用网页抓取工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:19 AM UTC
• Version: 1.0.0

Overview

This is a coherent web-scraping skill, but it can fetch any URL reachable from the host and save results locally without meaningful URL safety boundaries.

Install only if you are comfortable running a local scraper that can contact any URL the agent gives it, including localhost or private network addresses. Avoid using it on untrusted URLs or in environments with access to internal services or cloud metadata, and prefer pinned dependencies plus URL allowlisting before production use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scraper.py:11

Finding

Unrestricted URL Fetching Enables Server-Side Request Forgery

Content

View full analysis

Vulnerability Details

File Location: scraper.py, lines 11–40
Vulnerability Type: Server-Side Request Forgery (SSRF)
Risk Level: High

Vulnerable Code

python

def scrape_links(url, selector="a"):
    """抓取页面中所有匹配CSS选择器的链接"""
    try:
        resp = requests.get(url, timeout=30, headers={'User-Agent': 'Mozilla/5.0'})
        soup = BeautifulSoup(resp.text, 'html.parser')
        results = []
        for el in soup.select(selector):
            text = el.get_text(strip=True)
            href = el.get('href')
            if href:
                href = urljoin(url, href)
            results.append({"text": text, "href": href})
        return results
    except Exception as e:
        return [{"error": str(e)}]

def scrape_table(url, table_selector="table"):
    """抓取网页表格数据"""
    try:
        resp = requests.get(url, timeout=30, headers={'User-Agent': 'Mozilla/5.0'})
        soup = BeautifulSoup(resp.text, 'html.parser')
        table = soup.select_one(table_selector)
        if not table:
            return []
        rows = []
        for tr in table.select('tr'):
            cells = [td.get_text(strip=True) for td in tr.select('td, th')]
            if cells:
                rows.append(cells)
        return rows
    except Exception as e:
        return [{"error": str(e)}]

Technical Analysis

Both scraping functions pass a user-controlled URL directly to requests.get() without validating its scheme, hostname, port, resolved IP address, or redirect destination. The requests library follows redirects by default, so validating only the initial URL would also be insufficient.

The application therefore permits requests to loopback, private, link-local, and other restricted network addresses reachable from the host. Potential targets include internal administration interfaces, private APIs, local services, and cloud instance metadata endpoints. Because ...[truncated 1456 chars]

Remediation

View remediation

Remediation Suggestions

• Restrict accepted schemes to http and https.
• Parse URLs with urllib.parse.urlsplit() and reject malformed URLs, embedded credentials, unexpected ports, and ambiguous host representations.
• Resolve the destination hostname before connecting and reject loopback, private, link-local, multicast, unspecified, and reserved IPv4 and IPv6 addresses using the ipaddress module.
• Block known metadata destinations, including link-local cloud metadata addresses and metadata hostnames.
• Disable automatic redirects or validate every redirect destination using the same scheme, hostname, and resolved-address controls.
• Protect against DNS rebinding by ensuring the validated address is the address actually used for the connection.
• Prefer an explicit allowlist of approved domains when the intended scraping scope is known.
• Apply outbound firewall or proxy rules so the process cannot reach internal networks or metadata services.
• Call resp.raise_for_status() and impose response-size limits to reduce secondary availability risks.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 32–36
Vulnerability Type: Unpinned and Unverified Dependencies
Risk Level: Medium

Vulnerable Code

bash

pip install requests beautifulsoup4

Technical Analysis

The documented installation command retrieves the latest versions of requests and beautifulsoup4 available from the configured Python package index. It does not specify reviewed versions, verify package hashes, or use a lock file.

The package names correspond to the modules used by the application and do not exhibit an evident typosquatting issue. However, unconstrained installation makes builds non-reproducible and permits future, unreviewed package versions to enter the execution environment automatically. The actual source also depends on the user's configured package index, which could be unsafe or compromised.

Attack Path

1. A user follows the documented dependency installation command.
2. pip queries the configured package index and selects the latest matching releases.
3. No lock file, exact version constraint, or expected distribution hash is checked.
4. A compromised, unexpectedly modified, or incompatible release is downloaded and installed.
5. Dependency-controlled code executes during installation or when scraper.py imports and uses the package.

Impact Assessment

A malicious dependency release could execute with the privileges of the user installing or running the Skill. Depending on those privileges, the consequences could include access to local files and credentials, arbitrary network communication, modification of the environment, or arbitrary code execution.

No evidence was found that the currently named packages are malicious. The finding concerns the absence of controls that ensure reviewed and reproducible dependency versions.

Remediation

View remediation

Remediation Suggestions

• Pin dependencies to exact, reviewed versions in a requirements.txt file or supported lock file.
• Generate and verify cryptographic hashes for all distributions, and install with pip --require-hashes.
• Use a trusted package index or an internally controlled dependency mirror.
• Review and update pinned versions through a controlled process that includes vulnerability scanning and regression testing.
• Record transitive dependencies in the lock file to make the complete environment reproducible.
• Avoid executing installation commands with elevated operating-system privileges.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises network access and local file output behavior but does not declare any explicit tool scope or permissions boundary. In an agent ecosystem, this can lead to overbroad execution where the agent may perform outbound requests and write scraped data without clear user consent or runtime restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description and visible documentation are entirely in Chinese, including the claim of being '中文友好', with no indication that other languages are supported or that Chinese is a required locale. This can constitute a language/locale policy violation when the skill imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill omits disclosure that scraping sends requests to third-party websites and may store extracted content locally as CSV or JSON. This can expose request metadata such as IP, headers, and timing to external sites, and can also create unintended local persistence of potentially sensitive collected data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This file contains user-facing natural language in Chinese at L02, L12, L28, L45, and L54, while CLI usage and status messages are in English elsewhere. Because the skill does not offer the user a language/locale choice or explain that it is intended for a specific bilingual context, it may violate the policy against forcing a language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.