sg-property-scraper

Search Singapore property rental and sale listings with flexible filters. Use when asked to search Singapore properties, find rental or sale listings, check...

This skill appears to do what it claims: scrape PropertyGuru listings and optionally compute commute times via the Google Routes API. Before installing or running it: 1) Review the script source yourself (or run it in an isolated environment) to confirm there are no unexpected network endpoints or data exfiltration — the included code appears to target propertyguru.com.sg and Google only. 2) Be aware the scraper uses an impersonation profile to evade anti-bot protections — this can violate a target site's terms of service and, in some contexts, be legally or ethically problematic. 3) Only provide a Google Maps API key if you need commute calculations; scope the key to the minimum APIs (Routes) and monitor usage. 4) Install required Python packages into a virtualenv, and consider rate-limiting requests (respect robots.txt / site policies). If you need the agent to run the skill autonomously and are concerned about remote requests or ToS, either restrict autonomous invocation or use the --dry-run option to preview generated URLs before scraping.

Type: OpenClaw Skill Name: sg-property-scraper Version: 1.0.1 The `scripts/scrape.py` file contains a local file inclusion (LFI) vulnerability. The `--config` command-line argument allows specifying an arbitrary file path, which the script then attempts to open and parse as JSON. This could be exploited via prompt injection against the AI agent to read sensitive local files (e.g., `/etc/passwd`, `~/.ssh/id_rsa`), even if the JSON parsing fails, as the file read itself is an information disclosure risk. Additionally, the `--raw-param` argument allows adding arbitrary URL query parameters, which could be used to target the scraped website with injection attacks.