Versioned security assessment

Report ID: SA-20D15AEC

7/15/2026, 3:57:54 PM

web-scraper security assessment v1

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: codex Historical report
Skill name
web-scraper
Version
v1
Maintainer
zl2023github
Source
github.com/zl2023github/software-engineer-skills/tree/main/software-engineering/web-scraper
Coverage
1 Files scanned · 749 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

High

2 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most command findings are false positives caused by Markdown code fences, and the credential findings show normal parameters or local placeholders. Confirmed risks involve public proxy routing, unredacted response storage, anti-bot evasion, and capture of sensitive traffic.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Attestation superseded

A newer attestation exists.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 749 Lines analyzed

9 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 10 evidence locations

Filesystem access

May read or write local files.

Observed in 2 evidence locations

Env variables

May read values from the process environment.

Observed in 4 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 35 evidence locations

Capability review items (7)
Medium
SKILL.md:359
Python HTTP libraries
resp = requests.get(source, timeout=5)
The code downloads an unauthenticated public proxy list and trusts its contents for later routing. A compromised feed can direct traffic through hostile proxies.
Medium
SKILL.md:375
Python HTTP libraries
resp = requests.get('http://httpbin.org/ip', proxies=proxy, timeout=5)
The example sends cleartext HTTP traffic through an untrusted public proxy. The proxy can observe or alter the request and response.
Medium
SKILL.md:354
Hardcoded URL
'https://raw.githubusercontent.com/proxifly/free-proxy-list/main/proxies/proxies.json',
The hardcoded third-party feed supplies proxies without authenticity or trust checks. Feed compromise can redirect collected traffic through attacker-controlled systems.
Medium
SKILL.md:363
Hardcoded URL
'http': f'http://{p["ip"]}:{p["port"]}',
The code converts unverified feed entries into cleartext HTTP proxy endpoints. Those endpoints can inspect or modify routed traffic.
Medium
SKILL.md:364
Hardcoded URL
'https': f'http://{p["ip"]}:{p["port"]}',
HTTPS destinations are configured through unaudited HTTP proxy endpoints. This exposes connection metadata and creates interception risk if applications trust the proxy.
Medium
SKILL.md:375
Hardcoded URL
resp = requests.get('http://httpbin.org/ip', proxies=proxy, timeout=5)
The hardcoded httpbin URL uses cleartext HTTP through a public proxy. The unaudited proxy can read or tamper with the test traffic.
Medium
SKILL.md:643
Python file write/append
with open(fname, 'w') as f:
The interception hook writes complete HTTP responses to disk without redaction or access controls. Responses may contain credentials or personal data.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 High
SKILL.md:211-215SKILL.md:282-296SKILL.md:383-409SKILL.md:423-457SKILL.md:581-590
Anti-Bot Control Evasion Guidance
The skill teaches browser fingerprint spoofing, CAPTCHA automation, proxy rotation, and disabling robots.txt enforcement. These techniques can bypass site access and abuse controls.
The examples explicitly hide automation signals, simulate CAPTCHA interaction, rotate proxies, and set ROBOTSTXT_OBEY to false.
RISK-002 High
SKILL.md:515-533SKILL.md:625-645
Sensitive Traffic Capture Without Redaction
The mitmproxy examples print complete request headers and bodies and save complete responses. This can expose authentication tokens, personal data, and confidential payloads.
The code directly prints headers and request bodies, then writes full response text to local files without filtering.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    The guidance teaches fingerprint spoofing, CAPTCHA automation, and ignoring robots.txt.
    Require explicit authorization and remove examples that bypass access controls or site crawling policies.
  2. FIX-002
    High
    Traffic interception examples print headers and bodies and save complete responses.
    Redact credentials and personal data, restrict approved domains, encrypt storage, and define retention limits.
  3. FIX-003
    Medium
    The proxy pool trusts a public proxy feed and routes requests through unaudited servers.
    Use trusted authenticated proxies, validate feed integrity, and never send credentials through public proxies.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
20d15aec19fbd00408b0c18c6101a0baa88f4527
Content hash
9fc0bc1b40d9392b3bc726b7814e05174bd354fadf9feabf3b9eb2b50c31c262
Tree hash
2c59395ca48057f175214df9d47e6d3c50175e8d9c72816975bafb10a89e8e30
Skill path
skills/zl2023github/web-scraper
Audit payload hash
59132b89d0468d17a760bc755e19ad8d

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: superseded