Security audit

Scrapling

Security checks for vulnerabilities and agentic risk

Overview

This scraping skill has legitimate uses, but it includes under-scoped automation and instructions that can help bypass API, anti-bot, and dependency safety boundaries.

Install only after review. Use it only for public sites or systems where you have permission, avoid the API reverse-engineering and Cloudflare/stealth bypass sections, do not pass untrusted URLs/selectors or spider files to run.sh, and prefer pinned dependencies in an isolated environment.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: run.sh:16
Finding: Arbitrary Python Code Execution Through Unsanitized Command-Line Arguments
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: run.sh:12
Finding: Automatic Installation of Unpinned Runtime Dependencies
Content: View full analysis
/dev/null 2>&1 || python3 -m pip install scrapling ``` The explicit installation mode expands the exposure: ```bash install) echo "Installing Scrapling with all extras..." python3 -m pip install "scrapling[all]" scrapling install ;; ``` ### Technical Analysis Normal execution automatically installs the latest available `scrapling` package when it is absent. The package version and artifact hash are not pinned, and no lockfile or trusted package source is enforced. The `install` mode installs all optional extras and then invokes `scrapling install`, potentially downloading additional components such as browser binaries. This significantly expands the dependency and execution surface. Python packages may execute build-backend or setup logic during installation. Imported packages also execute module initialization code. Consequently, the effective code run by this Skill can change after the Skill itself has been audited. ### Attack Path 1. The Skill is invoked on a system where `scrapling` is not installed, or the user invokes `run.sh install`. 2. `pip` resolves the package and its transitive dependencies from the configured package index. 3. The latest matching, unpinned artifacts are downloaded. 4. Package build or installation logic executes locally. 5. The installed package is subsequently imported and executed by the wrapper. Exploitation would require compromise or malicious alteration of a resolved package, package index, dependency, or download path. The Skill provides no hash verification capable of detecting such a change. ### Impact Assessment A compromised dependency may execute with the privileges of the u ...[truncated 587 chars]
Remediation: View remediation

other

Warning

Location: SKILL.md:769
Finding: Potential Disclosure of Sensitive Target URLs to an External Screenshot Service
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:532
Finding: Guidance and Code for Replicating Authentication Controls on Undocumented APIs
Content: View full analysis
"Web scraping is 80% reverse engineering." This section covers advanced techniques to discover and replicate APIs directly from websites — often revealing data that's "hidden" behind paid APIs. ``` It instructs the operator to recover authentication logic from client-side JavaScript: ```markdown Auth tokens often generated client-side. Find them in `.js` files: **Steps:** 1. In Network tab, look at **Initiator** column 2. Click the `.js` file making the request 3. Search for auth header name (e.g., `sol-aut`, `Authorization`, `X-API-Key`) 4. Find the function generating the token ``` It then provides executable code that fabricates the discovered authentication header: ```python def generate_auth_token(): """Replicate discovered token generation logic.""" chars = string.ascii_letters + string.digits token = ''.join(random.choice(chars) for _ in range(40)) # Insert fixed string at random position fixed = "B9dls0fK" pos = random.randint(0, len(token)) return token[:pos] + fixed + token[pos:] def scrape_api_endpoint(url): """Hit discovered API endpoint with replicated auth.""" headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Accept': 'application/json', 'sol-aut': generate_auth_token(), # Replicate discovered header } response = requests.get(url, headers=headers) return response.json() ``` The complete replication pattern generalizes this behavior: ```python def get(self, endpoint, headers=None, auth_header=None, auth_pattern="random"): """Ma ...[truncated 2558 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The reverse-engineering section omits a strong prohibition on replicating auth headers or using hidden/premium endpoints and instead provides a practical recipe for doing so. Because it includes discovery, token generation, and request replay steps, it directly enables unauthorized access patterns rather than merely describing web research techniques.
Content: No source excerpt is available for this finding.

Ssd 4

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The cumulative narrative teaches how to inspect network traffic, locate hidden endpoints, extract auth logic from JavaScript, and replay requests with synthesized tokens. This is dangerous because the skill context is an operational scraping tool, so the instructions are immediately actionable for unauthorized backend access rather than academic discussion.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The 'spider' mode passes a user-supplied argument directly to python3, allowing execution of any local Python file. In a skill advertised for scraping, this expands behavior into a generic code runner, which is dangerous because it can execute arbitrary code with the invoking user's privileges if an attacker can influence the argument or convince a user to run an untrusted spider file.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill clearly enables outbound network activity through multiple fetchers, spiders, browser automation, and third-party HTTP requests, yet the manifest declares no explicit tool scope or permission boundaries. In an agent setting, that mismatch can cause over-broad runtime behavior and weak policy enforcement, especially because the skill also includes stealth and crawling features.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation actively promotes stealthy fetching, anti-bot handling, and Cloudflare solving but provides only limited high-level caution and no strong warning against bypassing technical protections. In context, this normalizes behavior that may violate site terms, trigger abuse, or be used against protected services.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This section goes beyond normal scraping by teaching users how to discover backend APIs, identify authentication headers in JavaScript, and generate replacement tokens to access endpoints directly. That materially facilitates unauthorized access to hidden, rate-limited, or premium backend functionality and lowers the barrier to misuse.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 557)May include surrounding context.
Example pattern:

text
# Found in Network tab: GET https://api.example.com/v1/users/transactions Response: {"data": [...], "pagination": {...}}

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 630)May include surrounding context.
Example pattern:

text
# Found in Network tab: GET https://api.example.com/v1/users/transactions Response: {"data": [...], "pagination": {...}}

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Sending target URLs to an external screenshot provider without an explicit privacy warning can expose confidential targets, internal hostnames, or investigative intent. In an agent workflow, users may not realize that a seemingly local extraction routine transmits data to a separate service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script silently performs external package management by auto-installing scrapling if it is missing, which triggers network access and code retrieval without explicit user consent. This is risky in agent or automation contexts because it changes the environment, introduces supply-chain exposure, and may surprise users who expected a local-only helper script.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The stealth mode performs remote fetching with anti-bot bypass behavior using a headless browser, but the script provides only minimal disclosure and no explicit warning about stealthy access. In the context of an agent skill, this is more dangerous because it can cause automated interaction with third-party sites in a way users may not realize, increasing legal, policy, and operational risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Spider mode executes a user-supplied Python file without any safety warning, which means the script can run arbitrary code under the current user's privileges. The absence of warning increases the likelihood of accidental unsafe use, especially because the skill framing suggests a scraping utility rather than a general-purpose code execution mechanism.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The brand-data example silently constructs a URL for an external screenshot service using the target site URL, creating an additional disclosure channel unrelated to direct scraping. This can leak user-supplied targets, internal URLs, or sensitive research subjects to a third party without clear consent or visibility.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.