Collecting reliable data from static pages, dynamic sites, and APIs requires several tools and careful engineering. This skill provides implementation templates for extraction, cleaning, storage, monitoring, and scaling.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "web-scraper" from https://skillstore.io/skills/zl2023github-web-scraper.md and its manifest at https://skillstore.io/api/skills/zl2023github-web-scraper/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.
Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
The command-execution alerts are false positives caused by Markdown code fences, and the credential alerts are ordinary parameters or a localhost Redis example. The skill does perform network requests and writes intercepted responses to disk. High-risk semantic concerns include anti-bot circumvention guidance and capture of potentially sensitive application traffic.
The skill teaches proxy rotation, CAPTCHA solving, browser fingerprint concealment, WAF avoidance, and disables Scrapy robots.txt enforcement. These techniques can bypass access controls and site policies.
The prose and code explicitly recommend defeating CAPTCHA, WebDriver detection, WAF controls, and robots.txt enforcement.
The mitmproxy examples print intercepted request headers and bodies and save complete responses. Authorization tokens, personal data, and confidential application content may be exposed.
The examples directly print headers and body content and persist raw responses without redaction or access controls.
The proxy pool downloads a mutable public list and routes requests through arbitrary entries without integrity checks. Malicious proxies can observe metadata or manipulate traffic.
The code fetches a remote public proxy list and immediately constructs routing configuration from its unverified entries.
Capability review items (12)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
This mitmproxy callback inspects live application requests, including URLs, headers, and bodies. It creates network-data exposure risk when traffic contains secrets or personal data.
This mitmproxy callback handles intercepted network requests and prints selected request bodies. Sensitive application data could be exposed through logs.
The interception callback creates a local output directory before saving captured responses. This enables persistent storage of potentially sensitive network data.
The URL points to a mutable GitHub-hosted public proxy list that the example downloads. Compromise or manipulation could redirect scraper traffic through hostile proxies.
The code constructs an HTTP proxy endpoint from remotely supplied host and port values. Requests routed through such untrusted proxies may be observed or altered.
The code configures HTTPS traffic to use an HTTP proxy built from remotely supplied values. An untrusted proxy can observe destinations and disrupt traffic.
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
zl2023github. (2026). web-scraper security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/zl2023github-web-scraper/audits/4
BibTeX citation
@techreport{zl2023github-zl2023github-web-scraper-2026,
author = {zl2023github},
title = {web-scraper security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/zl2023github-web-scraper/audits/4},
note = {Author version unspecified}
}
CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "web-scraper security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "zl2023github"
date-released: "2026-07-24"
url: "https://skillstore.io/skills/zl2023github-web-scraper/audits/4"
identifiers:
- type: other
value: "skillstore:zl2023github-web-scraper:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this scoreEvidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
65
Community
74
Spec Compliance
What You Can Build
Collect Public Research Data
Build a rate-limited collector for permitted public pages, then normalize and validate the extracted records.
Automate Dynamic Catalog Extraction
Use Playwright to load dynamic product pages, handle scrolling, and extract changing catalog fields.
Operate a Scalable Collection Pipeline
Design Scrapy workers, Redis scheduling, storage, monitoring, retries, and data quality controls for authorized sources.
Try These Prompts
Create a Basic Scraper
Create a polite scraper for [URL] that extracts [fields]. Respect robots.txt, use a one-second delay, and return a table.
Handle Dynamic Content
Build a Playwright scraper for [URL]. Wait for [selector], handle scrolling or pagination, extract [fields], and include retries and structured logs.
Build a Data Pipeline
Design a Scrapy pipeline for [domain] with deduplication, incremental updates, validation, and [database] storage. Keep robots.txt enforcement enabled.
Architect Distributed Collection
Architect an authorized collector for [sources] at [volume]. Include rate limits, queueing, observability, recovery, data lineage, privacy controls, and capacity estimates.
Best Practices
Confirm authorization, service terms, robots.txt rules, privacy limits, and retention requirements before collecting data.
Start with small samples, conservative concurrency, explicit timeouts, retries, and source-specific rate limits.
Preserve data lineage, validate required fields, monitor structural changes, and redact sensitive logs.
Avoid
Do not bypass CAPTCHA, WAF, authentication, or browser controls without explicit written authorization.
Do not route credentials or sensitive records through public proxies or unverified infrastructure.
Do not store raw intercepted traffic without redaction, encryption, restrictive permissions, and retention limits.
Frequently Asked Questions
Can this skill scrape JavaScript-rendered pages?
Yes. It provides Playwright patterns for loading pages, waiting for selectors, scrolling, and extracting rendered content.
Does it support API collection?
Yes. It includes paginated request patterns, optional bearer authentication, timeouts, response validation, and record aggregation.
Can it build distributed crawlers?
It provides Scrapy and Redis scheduling examples, but production infrastructure, capacity planning, and operations remain your responsibility.
Does the skill ensure scraping is legal?
No. You must verify authorization, service terms, robots.txt rules, privacy obligations, copyright, and local laws.
Can it inspect application traffic?
It includes mitmproxy examples for authorized testing. Captured headers, bodies, and responses may contain sensitive data and require protection.