📦

xcrawl-scrape

Name: xcrawl-scrape
Author: xcrawl-api

v1.0.2 Inhaltsrevision r1 Hohes Risiko ⚙️ Externe Befehle🌐 Netzwerkzugriff📁 Dateisystemzugriff🔑 Umgebungsvariablen

Extract Web Page Data with XCrawl

Web pages contain content that is difficult to collect in consistent formats. This skill guides XCrawl requests for page content, structured extraction, and asynchronous result retrieval.

Unterstützt: Claude Codex Code(CC)

⚠️ 38 Schlecht

Maintain this Skill? Claim it ⚠️ 38 Schlecht

Vor der Installation anhalten und eine Bestätigung anfordern.

Prüfen Sie den Plan und holen Sie vor Änderungen an Dateien die ausdrückliche Zustimmung des Benutzers ein.

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage

Review the Skillstore skill "xcrawl-scrape" from https://skillstore.io/skills/xcrawl-api-xcrawl-scrape.md and its manifest at https://skillstore.io/api/skills/xcrawl-api-xcrawl-scrape/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/xcrawl-api-xcrawl-scrape.md Signiertes manifest GET /api/skills/xcrawl-api-xcrawl-scrape/manifest Signiertes lockfile GET /api/skills/xcrawl-api-xcrawl-scrape/lockfile

Testen

„xcrawl-scrape“ wird verwendet. Illustrative request: fetch a public article as Markdown and links, then summarize the result.

Erwartetes Ergebnis:

Illustrative summary: the synchronous scrape completed with Markdown and links.
The response includes the page title, extracted content, outgoing links, and task metadata.
Actual content and credit usage depend on the upstream response.

„xcrawl-scrape“ wird verwendet. Illustrative request: extract product title, price, and currency asynchronously, then summarize task status.

Erwartetes Ergebnis:

Illustrative summary: the task progressed from pending to completed.
The extracted title is Sample Product, the price is 49, and the currency is USD.
These values are examples, not results from a live scrape.

Sicherheitsaudit

Hohes Risiko

v1 • 17.10.2026 Versionsbericht öffnen

All 150 static findings describe Markdown syntax, intended API calls, or dedicated configuration access rather than the alleged threats. Two contextual risks remain: disabled target TLS verification by default and unredacted request payloads that can expose supplied credentials. No evidence found of malicious intent, unauthorized credential collection, or embedded prompt injection.

Gescannte Dateien

255

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (2)

Hoch

SKILL.md:127-128 SKILL.md:165-166 SKILL.md:239-246

Output Contract Can Disclose Supplied Credentials

The output contract requires returning the request_payload used for the request without any redaction instruction. Supported payload fields include cookies, request headers, and webhook headers, which can expose session or callback secrets in conversation history.

The contract explicitly requires the used payload, and sensitive input fields are documented. Disclosure depends on the user supplying secret-bearing values.

Mittel

SKILL.md:127-131 SKILL.md:228-230

Target TLS Verification Disabled by Default

The request table documents skip_tls_verification with a true default, while the workflow advises keeping only necessary options. Requests that omit this option can accept invalid target certificates, allowing intercepted content or disclosure of supplied cookies and headers.

The insecure default is explicit in the parameter table, and examples do not override it. Actual provider behavior was not tested.

Risikofaktoren

⚙️ Externe Befehle (50)

🌐 Netzwerkzugriff (13)

SKILL.md:85 SKILL.md:33 SKILL.md:5 SKILL.md:32 SKILL.md:44 SKILL.md:54 SKILL.md:57 SKILL.md:65 SKILL.md:68 SKILL.md:74 SKILL.md:84 SKILL.md:85 SKILL.md:97

📁 Dateisystemzugriff (13)

SKILL.md:52 SKILL.md:63 SKILL.md:83 SKILL.md:52 SKILL.md:63 SKILL.md:83 SKILL.md:5 SKILL.md:19 SKILL.md:5 SKILL.md:19 SKILL.md:52 SKILL.md:63 SKILL.md:83

🔑 Umgebungsvariablen (16)

SKILL.md:52 SKILL.md:63 SKILL.md:83 SKILL.md:52 SKILL.md:63 SKILL.md:83 SKILL.md:17 SKILL.md:23 SKILL.md:45 SKILL.md:52 SKILL.md:56 SKILL.md:63 SKILL.md:67 SKILL.md:75 SKILL.md:83 SKILL.md:100

Geprüft von: codex

Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen

Berichtslink kopieren

https://skillstore.io/skills/xcrawl-api-xcrawl-scrape/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/xcrawl-api-xcrawl-scrape/security.svg)](https://skillstore.io/skills/xcrawl-api-xcrawl-scrape?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/xcrawl-api-xcrawl-scrape?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/xcrawl-api-xcrawl-scrape/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/xcrawl-api-xcrawl-scrape.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

xcrawl-api. (2026). xcrawl-scrape security audit report (audit version 1) [Author version 1.0.2]. Skillstore. https://skillstore.io/skills/xcrawl-api-xcrawl-scrape/audits/1

BibTeX-Zitat

@techreport{xcrawl-api-xcrawl-api-xcrawl-scrape-2026,
  author = {xcrawl-api},
  title = {xcrawl-scrape security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/xcrawl-api-xcrawl-scrape/audits/1},
  note = {Author version 1.0.2}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "xcrawl-scrape security audit report (audit version 1)"
version: "1.0.2"
type: report
authors:
  - name: "xcrawl-api"
date-released: "2026-10-17"
url: "https://skillstore.io/skills/xcrawl-api-xcrawl-scrape/audits/1"
identifiers:
  - type: other
    value: "skillstore:xcrawl-api-xcrawl-scrape:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel

Architektur

100

Wartbarkeit

Inhalt

Gemeinschaft

100

Spezifikationskonformität

Was Sie erstellen können

Collect Page Content for Research

Retrieve Markdown and links from a public source page, then request a separate summary when needed.

Extract Product Fields

Define product fields and accepted null values before requesting structured extraction from a product page.

Retrieve Rendered Page Evidence

Request a rendered screenshot with a defined viewport and inspect task status and API errors.

Diese Prompts ausprobieren

Fetch Page Markdown

Fetch [public URL] synchronously with XCrawl and return Markdown plus links. Enable target TLS verification and redact secrets from displayed payloads.

Extract Named Fields

Extract title, price, and currency from [product URL]. Allow null for missing values. Enable target TLS verification and redact secrets from displayed payloads.

Capture a Mobile Screenshot

Request a mobile screenshot of [public URL] with a 402 by 874 viewport. Enable target TLS verification and redact secrets from displayed payloads.

Run Asynchronous Schema Extraction

Scrape [public URL] asynchronously using [JSON Schema]. Enable target TLS verification. Poll with a retry limit until completion or failure. Redact secrets from displayed payloads.

Bewährte Praktiken

Define the authorized URL, required fields, accepted null values, and output formats before making a request.
Set request.skip_tls_verification to false, protect the local key file, and redact sensitive headers and cookies from displayed payloads.
Use bounded asynchronous polling and inspect terminal status, error details, and reported credit usage.

Vermeiden

Sending private URLs, cookies, or authentication headers to the hosted provider without authorization.
Relying on disabled target TLS verification or exposing secrets through raw payload output.
Polling indefinitely or treating extracted fields as verified facts without checking the source.

Häufig gestellte Fragen

What must I configure before using this skill?

Create ~/.xcrawl/config.json with your XCRAWL_API_KEY and ensure your account has credits. Use curl or a suitable Node runtime.

Which output formats are documented?

The documented formats are HTML, raw HTML, Markdown, links, summary, screenshot, and JSON. Availability depends on the upstream API.

Can I extract specific fields?

Yes. The skill documents extraction prompts and JSON Schema options. Define required fields and how missing values should be handled.

How does asynchronous scraping work?

Create an asynchronous scrape, capture its task identifier, and poll the result endpoint until completion or failure. Set a polling limit.

Does this skill crawl an entire website?

No. It documents single-page scrape requests and result retrieval. Automatic link discovery and full-site crawl management are outside its scope.

What security precautions should I take?

Enable target TLS verification, protect the local key file, and redact secrets from displayed payloads. Only submit data you may share with XCrawl.

Entwicklerdetails

Autor

xcrawl-api

Lizenz

MIT

Autorenversion

v1.0.2

Skillstore-Revision

Repository

https://github.com/xcrawl-api/xcrawl-skills/tree/768158d9cd1e318742845b2eb7b9b37ae75f2c27/skills/xcrawl-scrape

Ref.

e7474dc9298cb48291ba8e94ae55fd5e402b4b85

Aktualität der Wartung

17.10.2026

Nutzung

0 Downloads · 0 Aufrufe

Dateistruktur

📄 SKILL.md