# ScrapeGraphAI Pipeline Inlined With Credential/PII Harvest Prompt

- **Severity:** Medium
- **Signature ID:** `4f2a9c1e-7b56-4d3a-9e1f-2c8b6d40a7f3`
- **OWASP:** LLM06 (Excessive Agency)

## Summary

This detects when someone spins up a ScrapeGraphAI web-scraping pipeline directly on the command line, rather than as part of a normal project, and pairs it with instructions telling the AI to pull passwords, login data, or personal information, or to ignore robots.txt and evade crawler blocking. Either behavior alone is common and ignored; together they suggest an improvised data-harvesting operation.

## How the attack works

An attacker (or an AI agent acting on their behalf) writes a scraping pipeline inline, using `python -c` or a heredoc, instead of running it from a saved project file. The same command or API request includes a prompt telling the extractor to specifically pull credentials, authentication tokens, or personal data, or configures the scraper to disable robots.txt, rotate proxies, or spoof a search-engine crawler's user agent. The rule also checks hosted ScrapeGraphAI API calls that combine a target URL with this kind of harvest-intent prompt. The combination of improvised setup plus intent to extract sensitive data or evade site controls is what triggers the alert.

## Why it matters

Successful harvesting can pull login credentials or personal records from target websites at scale, feeding credential-stuffing, identity theft, or further account compromise. Because scraping and library use are otherwise legitimate, this activity can blend into normal developer traffic unless the specific harvest intent is caught.

## What you can do

- Review any one-off or inlined scraping scripts flagged by this rule to confirm they target only data the requester is authorized to collect.
- Require scraping jobs that touch credentials or PII to run from reviewed, version-controlled code rather than ad-hoc command-line invocations.
- Set organizational policy that scraping must respect robots.txt and site crawl controls unless there is a documented, approved exception.
- Track and pre-approve red-team or bug-bounty scraping engagements so they can be quickly distinguished from unauthorized activity during investigation.

## Known benign look-alikes

- Data or growth engineering running a one-off `python -c` scrapegraphai pipeline against their own property where the prompt legitimately asks for contact or e-mail fields (internal directory building, lead generation).
- QA and regression testing of scrapegraphai itself with credential-shaped prompts; partially suppressed by the test-runner and placeholder filters.
- Authorized red-team or bug-bounty scraping assessments, which look identical to unauthorized ones in telemetry - this is why the rule reports rather than blocks.
- README/demo snippets pasted verbatim by a developer that extract "emails"; suppressed only when placeholder tokens are present.
- An approved internal service calling the hosted ScrapeGraphAI API whose user_prompt happens to mention "contact information".

## References

- https://attack.mitre.org/techniques/T1119/
- https://attack.mitre.org/techniques/T1594/
- https://genai.owasp.org/llmrisk/llm06-excessive-agency/

---
Source: https://www.netzilo.com/threats/scrapegraphai-llm-scrape-credential-harvest