Scrapling-only, deterministic web crawler with clean SRP architecture, presets, checkpointing, and JSONL/report outputs.

This package appears to be a straightforward local crawler, but review a few things before running: 1) Presets (person-research, deep-research) set no_robots=True — they will ignore robots.txt; only use that for acceptable targets. 2) The plugin system loads and executes Python files from the plugins directory — inspect any plugins you use (and do not point plugin_dir at an untrusted path). 3) The runtime will fetch pages and write outputs/cache/checkpoint files under outputs/; run in an isolated directory or container if you want to limit side effects. 4) The instructions require pip installing dependencies from PyPI (notably scrapling); verify package versions and provenance. If you want lower risk, run the tests (pytest) and review the included plugins and requirements before executing the crawler against external or internal networks.

Type: OpenClaw Skill Name: kekik-crawler Version: 0.1.0-rc1 The skill is a web crawler that performs legitimate web fetching and local file storage. However, it is classified as 'suspicious' due to a significant Remote Code Execution (RCE) vulnerability. The `core/plugin_manager.py` module dynamically loads Python files from a user-specified `plugin_dir` (via `importlib.util.spec_from_file_location` and `spec.loader.exec_module`). While the default `plugin_dir` is 'plugins/' within the skill bundle, an attacker who can control the `--plugins` argument in `main.py` could point it to an arbitrary directory containing malicious Python code, leading to arbitrary code execution. There is no evidence of intentional malicious behavior such as data exfiltration, persistence, or prompt injection against the agent in the provided code or documentation.