Scrapling Web Scraping

Security checks across malware telemetry and agentic risk

Overview

This skill is a web-scraping wrapper, but it explicitly promotes bypassing Cloudflare and anti-bot protections, which is a material misuse risk.

Review carefully before installing. This skill may be acceptable for authorized testing or scraping your own sites, but avoid using stealth or Cloudflare-bypass modes on third-party sites without explicit permission. Install dependencies in an isolated environment and verify the external Scrapling package first.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI02: Tool Misuse and Exploitation
High
What this means

Using this skill against sites you do not own or have permission to test could violate terms of service, trigger blocking or account/IP penalties, and facilitate abusive scraping.

Why it was flagged

The skill explicitly advertises bypassing anti-bot protections on protected websites, which is broader and riskier than normal scraping and can be misused against third-party services.

Skill content
Bypass Cloudflare, handle JavaScript-heavy sites, and adapt to website changes automatically. Use when you need to scrape protected websites... or bypass anti-bot detection systems. Supports three modes - basic (fast HTTP), stealth (undetectable), dynamic (browser automation).
Recommendation

Use only on sites where you have authorization. Add clear domain scoping, rate limits, permission checks, and explicit user confirmation before using stealth or Cloudflare-bypass modes.

#
ASI04: Agentic Supply Chain Vulnerabilities
Low
What this means

Installing the dependency and browsers will run and store third-party software on the local machine.

Why it was flagged

The setup relies on an unpinned external Python package and a browser download step that are not represented by an install spec. This is expected for the stated browser-scraping purpose, but it expands the trusted code base.

Skill content
pip install "scrapling[all]"
scrapling install
...
First run: `scrapling install` to download browsers
Recommendation

Install in a virtual environment or container, pin and verify package versions, and review the Scrapling project/source before installation.