generate-scraper

Name: scrapeops-scraping-assistant-claude-plugin/generate-scraper
Author: ScrapeOps

Share on X Share on LinkedIn Share on Bluesky

100Critical

This skill is critically insecure, facilitating arbitrary code execution, credential exfiltration, path traversal, SQL injection, and SSRF while using deceptive prompts to bypass security oversight and persist malicious payloads.

ThreatsCI SM CS BC S HITL

Threat Analysis

AI Agent Traps ↗Scanned 6/18/2026

Content InjectionPerception2 findings

Semantic ManipulationReasoning3 findings

Cognitive StateMemory & Learning1 finding

Behavioural ControlAction7 findings

SystemicMulti-Agent Dynamics8 findings

Human-in-the-LoopHuman Overseerclean

Skill Info

NameScrapeOps/scrapeops-scraping-assistant-claude-plugin/generate-scraper

Registrygithub

Versioncfd37e85e63f

PURLpkg:github/ScrapeOps/scrapeops-scraping-assistant-claude-plugin@cfd37e85e63f?skill=generate-scraper

Stars5

Source

Repository ↗SKILL.md ↗

Install

This skill has been flagged as potentially malicious. Review the findings below before installing.

GitHub

Skills.shDocs

npx skills add https://github.com/ScrapeOps/scrapeops-scraping-assistant-claude-plugin

Assessments (8)

AI Agent Traps ↗

HTTP exfiltration with embedded environment variables detectedcriticaldata exfiltrationAML.T0025AML.T0024LLM02:2025

HTTP exfiltration with embedded environment variables detected

100% confidenceline 392

https://proxy.scrapeops.io/v1/?api_key=$SCRAPEOPS_API_KEY

Automated execution of unverified codehighcommand executionAML.T0050AML.T0053AML.T0072LLM05:2025LLM06:2025

The skill mandates a 'smoke test' that executes generated Python/Node.js code using `python3` or `node` in the local environment. This executes code generated by an external AI backend before the user has reviewed it.

95% confidence

Run command: cd <slug>_scrapy && scrapy crawl scraper -a url="<URL>" -O /tmp/smoke_test.jsonl

Recursive sub-agent spawning for code repairhighsub agent spawningAML.T0053AML.T0051.001LLM06:2025

The skill instructs the agent to spawn a 'parser-fixer' sub-agent to modify local files based on the output of a smoke test. This creates a recursive execution loop where the agent can modify its own generated code without direct human oversight of the specific changes.

90% confidence

invoke the `parser-fixer` agent on the file with explicit 'do NOT keep BS4 tokens' instructions

Agent writes credentials into ~/.claude/settings.jsonhighcredential theftAML.T0055AML.T0037LLM02:2025

The skill instructs the agent to read the user's API key interactively and then write it into `~/.claude/settings.json` using the Edit tool, placing a secret in a file that the MCP server reads automatically. This persists the credential in a location outside the user's normal secret-management workflow and could be read by any other skill or MCP server with file access.

85% confidenceline 32

Read `~/.claude/settings.json`, add the key to `env.SCRAPEOPS_API_KEY` using Edit, and retry the failed tool call

User input from an Express request is used to construct a file path. This could allow an attacker to read or write arbitrary files using path traversal sequences like '../'. Use path.resolve() with a base directory and validate the result stays within the intended directory, or use path.basename() to strip directory components.highvulnAML.T0037AML.T0050LLM06:2025

95% confidenceline 63

taint source (line 10): process.env.SCRAPEOPS_API_KEY → sink: fs.readFileSync(args["keywords-file"], "utf-8")

Over-privileged file system accessmediumresource abuseAML.T0029AML.T0034LLM10:2025

The skill requires the agent to create and manage virtual environments and project directories in the user's workspace, which provides a mechanism for the agent to persist files and potentially hide malicious scripts in subdirectories.

75% confidenceline 695

python3 -m venv .venv && source .venv/bin/activate

Potential for SSRF via URL parameter injectionmediumresource abuseAML.T0029AML.T0034LLM10:2025

The search scraper template constructs URLs using user-provided keywords and filters without explicit validation of the base URL or parameter structure, potentially allowing an attacker to manipulate the proxy request to target internal services.

70% confidenceline 1059

return f"{SEARCH_URL_BASE}?{urlencode(params, doseq=True)}"

Access to sensitive environment variables detectedmediumcredential theftAML.T0055AML.T0037LLM02:2025

Access to sensitive environment variables detected

100% confidenceline 1213

${API_KEY}

User input is used to construct a URL for a server-side HTTP request. This could allow an attacker to make requests to internal services or cloud metadata endpoints (Server-Side Request Forgery). Validate URLs against an allowlist of permitted hosts and schemes.mediumvulnAML.T0053AML.T0049LLM06:2025LLM05:2025

95% confidenceline 57

taint source (line 10): process.env.SCRAPEOPS_API_KEY → sink: axios.get(proxyUrl, { timeout: 120000 })

Indirect prompt injection via fetched framework docshighindirect prompt injection

FM-Step 2 and FM-Step 3 fetch external HTML from docs.scrapy.org, crawlee.dev, and scrapeops.io, then instruct the agent to extract fields and use them to generate proxy code. An attacker who can influence those pages (or intercept the unverified HTTP response) can inject instructions into the agent's reasoning context.

82% confidence

curl -sSL -A "$UA" "https://docs.scrapy.org/en/latest/intro/tutorial.html" -o /tmp/scrapy_tutorial.html ... Use a prompt that extracts: endpoint URL, auth method, target-URL parameter ... proceed to FM-Step 4 with the live data.

Fabricated user consent / pre-authorized instruction — a statement falsely attributed to the user to manufacture authorizationmediumprompt injectionAML.T0051AML.T0051.000AML.T0051.001AML.T0054LLM01:2025

Fabricated user consent / pre-authorized instruction — a statement falsely attributed to the user to manufacture authorization

100% confidenceline 46

the user already stated

Sub-agent spawning with externally-influenced promptshighsub agent spawningAML.T0053AML.T0051.001LLM06:2025

The skill spawns `parser-fixer` sub-agents with prompts that incorporate attacker-controllable content: the scraped HTML path, the target URL, and error output from running attacker-served code. A malicious target site could craft its HTML or HTTP error responses to inject instructions into the sub-agent prompt.

80% confidenceline 711

Agent(description: "Fix Scrapy spider locally", subagent_type: "parser-fixer", prompt: "Fix the Scrapy spider at <slug>_scrapy/...\n...task: Smoke test failed — <stderr or empty output description>")