Web Scraper Trae

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:36 AM UTC
• Version: 1.0.1

Overview

The skill is a straightforward web scraper, but it gives the agent broad, under-scoped ability to render arbitrary URLs and return full page contents while disabling Chromium sandbox protections.

Install only if you will run it in an isolated environment and trust the URLs being scraped. Avoid using it on private, authenticated, localhost, intranet, cloud metadata, or unknown hostile pages unless destination controls, sandboxing, and output limits are added.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14
• Finding: Unpinned Playwright and Chromium Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 14-15 **Vulnerability Type**: Unpinned third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npm install playwright npx playwright install chromium ``` ### Technical Analysis The prerequisites install the currently published Playwright package and its associated Chromium binary without specifying an audited version, lockfile, or integrity verification mechanism. Consequently, the components executed during future installations may differ from those reviewed during this audit. The npm installation process may execute package lifecycle scripts with the permissions of the agent account. The Chromium installation command also downloads executable browser artifacts determined by the installed Playwright release. Compromise of a relevant package release, registry account, dependency, distribution endpoint, or installation channel could therefore result in unreviewed code executing in the local environment. This is a supply-chain weakness rather than evidence that the current official Playwright package is malicious. ### Attack Path 1. An attacker compromises a relevant package release, transitive dependency, maintainer account, registry channel, or browser-artifact distribution path. 2. The agent follows the Skill prerequisites and runs `npm install playwright` without a fixed version or trusted lockfile. 3. npm retrieves the attacker-influenced release and may execute its lifecycle code with the agent process's permissions. 4. The subsequent `npx playwright install chromium` command downloads executable browser components selected by that release. 5. Malicious installation code or browser artifacts can access resources available to the agent account and potentially alter the scraping environment. ### Impact Assessment Successful exploitation could allow arbitrary code execution with the privileges of the user running npm. The reachable scope may include project f ...[truncated 229 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin Playwright to an exact, reviewed version rather than installing the latest release. - Commit a package manifest and lockfile containing integrity hashes. - Use `npm ci` against the reviewed lockfile instead of an unconstrained `npm install`. - Disable dependency lifecycle scripts where they are unnecessary and compatible with the installation process. - Retrieve browser binaries from a controlled or verified source and validate their integrity. - Run dependency installation in an isolated, unprivileged build environment with restricted credentials, filesystem access, and outbound networking. - Add automated dependency scanning and require explicit review before updating Playwright or its browser artifacts. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:21
• Finding: Chromium Security Sandbox Explicitly Disabled<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 21-26 **Vulnerability Type**: Unsafe browser security configuration **Risk Level**: High ### Vulnerable Code ```javascript const browser = await chromium.launch({ headless: true, args: ['--no-sandbox', '--disable-setuid-sandbox'] }); ``` ### Technical Analysis The launch configuration explicitly disables Chromium's sandbox and setuid sandbox. These mechanisms are important defense-in-depth boundaries designed to contain a compromised browser renderer and reduce its ability to interact with the host operating system. The Skill is specifically intended to render user-selected, potentially untrusted webpages. Disabling browser sandboxing substantially increases the consequence of a Chromium vulnerability triggered by hostile page content. If a browser-engine exploit achieves renderer code execution, the absence of the configured sandbox boundaries may allow the exploit to operate directly with the permissions and accessible resources of the Node.js agent process. The configuration does not independently exploit the host, but it removes a critical mitigation in precisely the context where attacker-controlled web content is processed. ### Attack Path 1. An attacker supplies a URL hosting content designed to exploit a vulnerability in the installed Chromium version. 2. The Skill launches Chromium with both `--no-sandbox` and `--disable-setuid-sandbox`. 3. Chromium navigates to and renders the hostile page. 4. The hostile content triggers a compatible browser-engine vulnerability. 5. Because the browser sandbox has been disabled, attacker-controlled native code may access resources available to the browser process without first overcoming the normal Chromium sandbox boundary. ### Impact Assessment Successful exploitation could provide code execution with the privileges of the account running the Skill. Depending on the surrounding environment, this may expose project files, environm ...[truncated 208 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `--no-sandbox` and `--disable-setuid-sandbox` from the default browser launch configuration. - Run Chromium as a dedicated, unprivileged user on a host that supports its normal sandbox. - If the deployment platform cannot support sandboxed Chromium, execute the entire scraper inside a disposable, hardened container or micro-VM. - Restrict container capabilities, mount the filesystem read-only where practical, and deny access to host sockets, credentials, and sensitive directories. - Apply outbound network controls and isolate the browser from unrelated internal services. - Keep Chromium and Playwright patched to reviewed versions. - Apply CPU, memory, process, and execution-time limits to reduce the effect of browser exploitation or denial-of-service content. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:29
• Finding: Unrestricted User-Controlled URL Navigation Enables SSRF<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 29 and 43-51 **Vulnerability Type**: Server-side request forgery and unrestricted resource retrieval **Risk Level**: High ### Vulnerable Code ```javascript await page.goto(url, { waitUntil: 'networkidle', timeout: 60000 }); ``` The navigation value is taken directly from a command-line argument: ```javascript const url = process.argv[2]; if (!url) { console.error('请提供 URL 参数'); process.exit(1); } scrape(url).then(result => { console.log('=== SCRAPE_RESULT ==='); console.log(JSON.stringify(result, null, 2)); ``` The fetched content includes the complete page body and HTML: ```javascript const title = await page.title(); const text = await page.textContent('body'); const html = await page.content(); await browser.close(); return { title, text, html, url }; ``` ### Technical Analysis The URL is accepted from the caller and passed directly to `page.goto` without validating its scheme, resolved address, port, hostname, or redirect chain. There is no denylist for loopback, private, link-local, reserved, or cloud metadata address ranges. There is also no destination allowlist. Because the request originates from the machine running the Skill, it may reach services that are inaccessible to the external caller. Browser navigation can consequently become an SSRF primitive. If a reachable internal HTTP service returns content that Chromium can render, the Skill extracts the text and full HTML and prints that data to standard output. Initial URL checks alone would be insufficient because an allowed public URL could redirect to an internal destination or resolve through attacker-controlled DNS. The code must validate resolved addresses and every redirect destination. The implementation also lacks explicit response-size and output-size limits. A hostile or unusually large page could consume excessive memory when both text and complete HTML are retained and serialized. ### Attack P ...[truncated 1568 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Restrict navigation to explicitly required schemes, preferably `https:`. - Use a destination allowlist when the intended scraping scope is known. - Reject loopback, private, link-local, multicast, reserved, unspecified, and cloud metadata address ranges for both IPv4 and IPv6. - Resolve hostnames before navigation and validate every returned IP address. - Revalidate the hostname and resolved address after each redirect; do not rely only on validating the initial URL. - Defend against DNS rebinding by controlling resolution and connection behavior or by placing the browser behind a network proxy that enforces destination policy. - Block unnecessary ports and deny access to internal networks through firewall or container egress rules. - Use a fresh browser context without ambient cookies, client certificates, proxy credentials, or saved authentication state. - Limit response size, DOM size, extracted text size, and serialized output size. - Apply strict memory, CPU, and total execution limits. - Return only the fields required by the task; avoid returning full HTML by default. - Record blocked navigation attempts and destination-validation failures without logging sensitive response content. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The skill instructs use of `npx playwright` without pinning a version, which allows whatever version is current at execution time to be fetched and run. This creates a supply-chain and reproducibility risk: a compromised upstream package, typo-squatted dependency path, or breaking update could execute unexpected code in the agent environment.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This skill is explicitly designed to fetch arbitrary user-supplied URLs and return full page text and HTML, but it provides no warning or guardrails around sensitive destinations, internal hosts, authenticated pages, or the exfiltration of page contents back to the caller. In an agent context, that increases the risk of SSRF-style access, retrieval of internal-only resources, and unintended disclosure of sensitive data present in scraped content.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The example code uses Chinese-only error messages in string literals, which imposes a specific language choice without asking the user or documenting a locale-specific purpose. This is a natural-language policy issue because the skill does not offer language selection or explain why Chinese is required.

Static analysis

No suspicious patterns detected.