Security audit

Web Scraper Trae

Security checks for vulnerabilities and agentic risk

Overview

The skill is a straightforward web scraper, but it gives the agent broad, under-scoped ability to render arbitrary URLs and return full page contents while disabling Chromium sandbox protections.

Install only if you will run it in an isolated environment and trust the URLs being scraped. Avoid using it on private, authenticated, localhost, intranet, cloud metadata, or unknown hostile pages unless destination controls, sandboxing, and output limits are added.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:14
Finding: Unpinned Playwright and Chromium Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:21
Finding: Chromium Security Sandbox Explicitly Disabled
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:29
Finding: Unrestricted User-Controlled URL Navigation Enables SSRF
Content: View full analysis
{ console.log('=== SCRAPE_RESULT ==='); console.log(JSON.stringify(result, null, 2)); ``` The fetched content includes the complete page body and HTML: ```javascript const title = await page.title(); const text = await page.textContent('body'); const html = await page.content(); await browser.close(); return { title, text, html, url }; ``` ### Technical Analysis The URL is accepted from the caller and passed directly to `page.goto` without validating its scheme, resolved address, port, hostname, or redirect chain. There is no denylist for loopback, private, link-local, reserved, or cloud metadata address ranges. There is also no destination allowlist. Because the request originates from the machine running the Skill, it may reach services that are inaccessible to the external caller. Browser navigation can consequently become an SSRF primitive. If a reachable internal HTTP service returns content that Chromium can render, the Skill extracts the text and full HTML and prints that data to standard output. Initial URL checks alone would be insufficient because an allowed public URL could redirect to an internal destination or resolve through attacker-controlled DNS. The code must validate resolved addresses and every redirect destination. The implementation also lacks explicit response-size and output-size limits. A hostile or unusually large page could consume excessive memory when both text and complete HTML are retained and serialized. ### Attack P ...[truncated 1568 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The skill instructs use of npx playwright without pinning a version, which allows whatever version is current at execution time to be fetched and run. This creates a supply-chain and reproducibility risk: a compromised upstream package, typo-squatted dependency path, or breaking update could execute unexpected code in the agent environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This skill is explicitly designed to fetch arbitrary user-supplied URLs and return full page text and HTML, but it provides no warning or guardrails around sensitive destinations, internal hosts, authenticated pages, or the exfiltration of page contents back to the caller. In an agent context, that increases the risk of SSRF-style access, retrieval of internal-only resources, and unintended disclosure of sensitive data present in scraped content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The example code uses Chinese-only error messages in string literals, which imposes a specific language choice without asking the user or documenting a locale-specific purpose. This is a natural-language policy issue because the skill does not offer language selection or explain why Chinese is required.
Content: No source excerpt is available for this finding.