Scrapling

Adaptive web scraping framework with anti-bot bypass and spider crawling.

Install only after reviewing the helper script and limiting use to sites where you have permission to scrape. Avoid passing untrusted URLs, selectors, or spider files to run.sh, use an isolated virtual environment, and do not use the API-replication or bypass examples against paid, protected, rate-limited, or terms-prohibited services.

Type: OpenClaw Skill Name: scrapling Version: 1.0.8 The skill bundle is classified as suspicious due to critical shell injection and arbitrary code execution vulnerabilities in the `run.sh` script. Specifically, the `fetch` and `stealth` modes directly interpolate user-supplied `$URL` and `$SELECTOR` into `python3 -c` commands without sanitization, allowing for arbitrary Python code or shell command injection. The `spider` mode is even more severe, directly executing the `$URL` argument as a Python script (`python3 "$URL"`), which is a clear arbitrary code execution risk. While the `SKILL.md` documentation describes powerful web scraping and API reverse engineering techniques (including Cloudflare bypass and auth token discovery) that could be misused, it presents them as a methodology rather than explicit instructions for malicious activity. The vulnerabilities in `run.sh` are implementation flaws, not evidence of intentional malice within the skill's stated purpose.