Zoomin Docs Portal Scraper Tool

Scrape documentation content from Zoomin Software portals using Playwright browser automation to handle dynamic content loading. Use when standard web fetchi...

This skill appears to be a straightforward Playwright-based scraper and contains no requests for credentials or hidden network exfiltration. However, before installing or running it: - Note the mismatch: the SKILL.md claims 'Zoomin' but the code contains many Zerto-specific assumptions (default output names, URL sanitization and content cleanup). If you expect a generic Zoomin scraper, test on a small set of URLs first. - You must run `pip install playwright` and `playwright install chromium` yourself; these commands download browser binaries. Prefer doing this in an isolated virtualenv or sandbox. - The wrapper example in SKILL.md uses named parameters but the script expects positional args; call run_scraper.sh with: ./run_scraper.sh <urls_file> <output_dir> <venv_path>. - The scraper will visit arbitrary URLs you supply and write text files to disk. Only provide URLs you are permitted to scrape (observe robots.txt / terms of service) and run the script in a directory where writing files is acceptable. - If you want to be extra cautious, review/modify the code to remove or adapt Zerto-specific patterns, and run the scraper on a controlled test list before bulk use. Given the repackaging inconsistencies and guidance mismatches, treat this skill as safe-but-suspicious until you've validated it in your environment.

Type: OpenClaw Skill Name: zoomin-scraper-recklessop Version: 1.0.2 The skill bundle is classified as suspicious due to several critical vulnerabilities that could lead to arbitrary code execution, local file read/write, and data exfiltration. Specifically, `scripts/run_scraper.sh` is vulnerable to shell injection by directly sourcing a user-provided `VENV_PATH` without validation. Additionally, `scripts/scrape_zoomin.py` and `scripts/analyze_docs_batch.py` accept file paths and output directories directly from command-line arguments without sanitization, enabling an attacker to read arbitrary local files (e.g., via `urls_file_path`) or write scraped content to arbitrary locations (e.g., via `output_dir`). While the skill's stated purpose is legitimate web scraping, these vulnerabilities present significant attack surfaces.