Why this verdict
- inconclusive: gap skill_frontmatter_invalid at SKILL.md
- inconclusive: gap skill_manifest_missing at package.json
- inconclusive: unresolved question on EXFIL
Security findings 0
No individual findings recorded
The inconclusive verdict rests on the open questions and coverage gaps below.
Notes 3
Capabilities, vulnerabilities and disclosed behavior worth knowing. Nothing here works against the person who installs it, so notes never change the verdict.
Credential access
mediumNoteConfirmed on reviewhigh confidenceThe client reads the ScraperCity service key from the SCRAPERCITY_API_KEY environment variable and sends it only as a Bearer token to the wrapped service host, which is the expected use of the declared API client; the env read is undeclared residue but necessary for the service.
process.env.SCRAPERCITY_API_KEY
vector:code
Reviewer's reasoning
The key is read from an env var and sent only as a Bearer token to the ScraperCity service that issued it, which is the expected use of the declared client (test 5, credential for the wrapped service).
Credential access
mediumNoteConfirmed on reviewhigh confidenceThe client reads the ScraperCity key from the CLI's own rc file in the home directory as a fallback credential for the same service; this is the wrapped service's login store and is used only for that service's requests.
fs.readFileSync(RC_PATH, 'utf-8')
vector:code
Reviewer's reasoning
The fallback reads the CLI's own rc file, the login store written by saveApiKey for the same service. The key is used only for that service's requests, so it is a note under test 5.
Credential access
mediumNoteConfirmed on reviewmedium confidenceThe shared request helper sends the ScraperCity Bearer API key to whatever absolute URL a caller passes, and postEndpoint forwards its endpoint argument straight into that helper, so a caller can route the key to a non-ScraperCity host.
const url = urlPath.startsWith('http') ? urlPath : `${BASE}${urlPath}`vector:code
Reviewer's reasoning
Sending the key to an absolute URL is a real routing weakness, but it needs a caller, such as an agent steered by a malicious page or prompt, to pass an attacker host. That makes it a vulnerability that needs outside input (test 3), so it stays a note rather than abuse.
Third-party flags 1
Behavior aimed at other sites, platforms or people, such as evading rate limits or offensive-security tooling. It does not affect the person who installs it, so it never changes the verdict.
Reconnaissance
infoNoteConfirmed on reviewmedium confidenceThe criminal-records tool searches named individuals across registries; this is its declared core capability, but the subjects are third parties who did not consent to the lookup.
Search nationwide criminal records across Sex Offender Registry
vector:metadata
Reviewer's reasoning
The criminal-records search is the tool's declared core capability (test 5), and its subjects are third parties, not the installer. The harm to those named people is not against the user's own machine or accounts.
Open questions 1
What the analysis could not settle from the code alone.
Does any MCP tool or launcher call configure() with a baseUrl value taken from tool input or an environment setting? If so, the Bearer API key would be sent to a host other than app.scrapercity.com, which would settle the EXFIL and CRED level.
Data exfiltration
Coverage gaps 2
Parts of the artifact the static analysis could not fully examine.
skill_frontmatter_invalid missing name/description frontmatter
SKILL.md
skill_manifest_missing no readable SKILL.md for skill target
package.json
