Skills web-scraper
๐Ÿ“ฆ

web-scraper

Content revision r2 High Risk โš™๏ธ External commands๐ŸŒ Network access๐Ÿ“ Filesystem access๐Ÿ”‘ Env variables

Build Reliable Web Data Collectors

Collecting reliable data from static pages, dynamic sites, and APIs requires several tools and careful engineering. This skill provides implementation templates for extraction, cleaning, storage, monitoring, and scaling.

Supports: Claude Codex Code(CC)
โš ๏ธ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "web-scraper" from https://skillstore.io/skills/zl2023github-web-scraper.md and its manifest at https://skillstore.io/api/skills/zl2023github-web-scraper/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Test it

Using "web-scraper". Extract article titles, publication dates, and links from an approved news archive.

Expected outcome:

A normalized table with title, publication date, source link, validation status, and collection timestamp.

Using "web-scraper". Design a recurring collector for a permitted dynamic catalog with daily updates.

Expected outcome:

  • Playwright extraction flow with stable selector guidance
  • Incremental update and deduplication strategy
  • Rate limits, retries, logs, and health checks
  • Validated records prepared for database storage

Using "web-scraper". Assess a proposed Scrapy deployment for several authorized sources.

Expected outcome:

A deployment plan covering workers, Redis scheduling, storage, monitoring, failure recovery, data validation, and source-specific limits.

Security Audit

High Risk
v4 โ€ข 7/24/2026 Open versioned report

The command-execution alerts are false positives caused by Markdown code fences, and the credential alerts are ordinary parameters or a localhost Redis example. The skill does perform network requests and writes intercepted responses to disk. High-risk semantic concerns include anti-bot circumvention guidance and capture of potentially sensitive application traffic.

1
Files scanned
749
Lines analyzed
12
Review items
0
False positives ignored

Confirmed security concerns (3)

High
Anti-Bot Control Circumvention Guidance
The skill teaches proxy rotation, CAPTCHA solving, browser fingerprint concealment, WAF avoidance, and disables Scrapy robots.txt enforcement. These techniques can bypass access controls and site policies.
The prose and code explicitly recommend defeating CAPTCHA, WebDriver detection, WAF controls, and robots.txt enforcement.
High
Sensitive Application Traffic Capture
The mitmproxy examples print intercepted request headers and bodies and save complete responses. Authorization tokens, personal data, and confidential application content may be exposed.
The examples directly print headers and body content and persist raw responses without redaction or access controls.
Medium
Untrusted Public Proxy Ingestion
The proxy pool downloads a mutable public list and routes requests through arbitrary entries without integrity checks. Malicious proxies can observe metadata or manipulate traffic.
The code fetches a remote public proxy list and immediately constructs routing configuration from its unverified entries.
Capability review items (12)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
HTTP client library
def request(flow: http.HTTPFlow):
This mitmproxy callback inspects live application requests, including URLs, headers, and bodies. It creates network-data exposure risk when traffic contains secrets or personal data.
High
HTTP client library
def request(flow: http.HTTPFlow):
This mitmproxy callback handles intercepted network requests and prints selected request bodies. Sensitive application data could be exposed through logs.
High
Python file write/append
with open(fname, 'w') as f:
The callback writes complete intercepted response text to disk. This can persist credentials, personal data, or other sensitive application content.
Medium
Python os file operations
os.makedirs(OUTPUT_DIR, exist_ok=True)
The interception callback creates a local output directory before saving captured responses. This enables persistent storage of potentially sensitive network data.
Low
Python HTTP libraries
resp = requests.get(url, headers=headers, timeout=10)
The example performs an HTTP GET to a supplied URL. Network access is intentional and can contact arbitrary user-selected hosts.
Low
Python HTTP libraries
resp = requests.get(base_url, params=params, headers=headers, timeout=15)
The API collector performs repeated HTTP GET requests to a supplied base URL. It may send a bearer token to that selected endpoint.
Low
Python HTTP libraries
resp = requests.get(source, timeout=5)
The proxy loader downloads a mutable public proxy list from GitHub. This is real external network access to untrusted operational data.
Low
Python HTTP libraries
resp = requests.get('http://httpbin.org/ip', proxies=proxy, timeout=5)
The code sends a test request to httpbin through a selected public proxy. Both the external request and untrusted routing are intentional.
Low
Hardcoded URL
'https://raw.githubusercontent.com/proxifly/free-proxy-list/main/proxies/proxies.json',
The URL points to a mutable GitHub-hosted public proxy list that the example downloads. Compromise or manipulation could redirect scraper traffic through hostile proxies.
Low
Hardcoded URL
'http': f'http://{p["ip"]}:{p["port"]}',
The code constructs an HTTP proxy endpoint from remotely supplied host and port values. Requests routed through such untrusted proxies may be observed or altered.
Low
Hardcoded URL
'https': f'http://{p["ip"]}:{p["port"]}',
The code configures HTTPS traffic to use an HTTP proxy built from remotely supplied values. An untrusted proxy can observe destinations and disrupt traffic.
Low
Hardcoded URL
resp = requests.get('http://httpbin.org/ip', proxies=proxy, timeout=5)
The hardcoded httpbin endpoint is used for a real external proxy test. It discloses connection metadata to the endpoint and selected proxy.
Audited by: codex View Audit History โ†’
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/zl2023github-web-scraper/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/zl2023github-web-scraper/security.svg)](https://skillstore.io/skills/zl2023github-web-scraper?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/zl2023github-web-scraper?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/zl2023github-web-scraper/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/zl2023github-web-scraper.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA ยท BibTeX ยท CFF)

APA citation

zl2023github. (2026). web-scraper security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/zl2023github-web-scraper/audits/4

BibTeX citation

@techreport{zl2023github-zl2023github-web-scraper-2026, author = {zl2023github}, title = {web-scraper security audit report (audit version 4)}, institution = {Skillstore}, year = {2026}, number = {4}, url = {https://skillstore.io/skills/zl2023github-web-scraper/audits/4}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "web-scraper security audit report (audit version 4)" version: "unspecified" type: report authors: - name: "zl2023github" date-released: "2026-07-24" url: "https://skillstore.io/skills/zl2023github-web-scraper/audits/4" identifiers: - type: other value: "skillstore:zl2023github-web-scraper:audit:4" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
65
Community
74
Spec Compliance

What You Can Build

Collect Public Research Data

Build a rate-limited collector for permitted public pages, then normalize and validate the extracted records.

Automate Dynamic Catalog Extraction

Use Playwright to load dynamic product pages, handle scrolling, and extract changing catalog fields.

Operate a Scalable Collection Pipeline

Design Scrapy workers, Redis scheduling, storage, monitoring, retries, and data quality controls for authorized sources.

Try These Prompts

Create a Basic Scraper
Create a polite scraper for [URL] that extracts [fields]. Respect robots.txt, use a one-second delay, and return a table.
Handle Dynamic Content
Build a Playwright scraper for [URL]. Wait for [selector], handle scrolling or pagination, extract [fields], and include retries and structured logs.
Build a Data Pipeline
Design a Scrapy pipeline for [domain] with deduplication, incremental updates, validation, and [database] storage. Keep robots.txt enforcement enabled.
Architect Distributed Collection
Architect an authorized collector for [sources] at [volume]. Include rate limits, queueing, observability, recovery, data lineage, privacy controls, and capacity estimates.

Best Practices

  • Confirm authorization, service terms, robots.txt rules, privacy limits, and retention requirements before collecting data.
  • Start with small samples, conservative concurrency, explicit timeouts, retries, and source-specific rate limits.
  • Preserve data lineage, validate required fields, monitor structural changes, and redact sensitive logs.

Avoid

  • Do not bypass CAPTCHA, WAF, authentication, or browser controls without explicit written authorization.
  • Do not route credentials or sensitive records through public proxies or unverified infrastructure.
  • Do not store raw intercepted traffic without redaction, encryption, restrictive permissions, and retention limits.

Frequently Asked Questions

Can this skill scrape JavaScript-rendered pages?
Yes. It provides Playwright patterns for loading pages, waiting for selectors, scrolling, and extracting rendered content.
Does it support API collection?
Yes. It includes paginated request patterns, optional bearer authentication, timeouts, response validation, and record aggregation.
Can it build distributed crawlers?
It provides Scrapy and Redis scheduling examples, but production infrastructure, capacity planning, and operations remain your responsibility.
Does the skill ensure scraping is legal?
No. You must verify authorization, service terms, robots.txt rules, privacy obligations, copyright, and local laws.
Can it inspect application traffic?
It includes mitmproxy examples for authorized testing. Captured headers, bodies, and responses may contain sensitive data and require protection.
What must be customized before use?
Configure domains, selectors, schemas, authentication, storage, rate limits, retries, monitoring, privacy controls, and retention policies.

Developer Details

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Ref

88a8e9a07f4c54ab105c1c41b6267c287146b07b

Maintenance freshness

7/26/2026

Usage

2 downloads ยท 1 views

File structure

๐Ÿ“„ SKILL.md

More from zl2023github

View all
View all