scrapling

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill shows and examples use command-line flags that accept cookies and proxy URLs (including username:password formats) and even demonstrates an inline cookie value, which encourages embedding secrets directly into generated commands/outputs.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). Exclusion: Scrapling’s runtime workflow reads free text only from the pages you explicitly fetch (e.g., via scrapling extract get/fetch/... or Fetcher/FetcherSession with an attacker-chosen URL), not from an automatic “outsider text feed/queue” without prior item selection.