lucasmartins-ai/lookacrawler

Review signals: 1 connection review, 93 known vulnerability, 1 sensitive read.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written; read only test files inside the test workspace or its temporary folders; resolver address lookups that send no data.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 25 distinct locations. 7 attributed processes.

OSV reports a known vulnerability in this dependency version. 15 distinct locations. 93 findings.

A repository process attempted to read this sensitive path. Kind of file: package registry login. 1 attributed processes.

PID 2064: <guest-path> · <guest-path>

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• CLI extracts a page to Markdown: Real input produced the expected result: documentation examples

  Source: bun run cli.ts extract https://news.ycombinator.com --mode fast

  Input: https://example.com

  Expected: Markdown text of the page

  Command: <guest-path> run cli.ts extract https://example.com --mode fast

  Observed: documentation examples without needing permission. This is not a service; avoid relying on it for testing and monitoring purposes.

• MCP server exposes extract_web_content tool: Real input produced the expected result: documentation examples

  Source: **Tools:** `extract_web_content`, `crawl_website`, `map_website`

  Input: {"tool": "extract_web_content", "arguments": {"url": "https://example.com", "mode": "fast"}}

  Expected: Markdown text returned by the tool

  Command: <guest-path> run index.ts tools/call {"tool": "extract_web_content", "arguments": {"url": "https://example.com", "mode": "fast"}}

  Observed: documentation examples without needing permission. This is not a service; avoid relying on it for testing and monitoring purposes."}]}

• CLI scores buying intent of a text: Real input produced the expected result: "isLead": true

  Source: bun run cli.ts intent "Procuro um sofá até R$ 2.500"

  Input: Procuro um sofá até R$ 2.500

  Expected: JSON with isLead true

  Command: <guest-path> run cli.ts intent 'Procuro um sofá até R$ 2.500'

  Observed: "isLead": true, "score": 85, "matched": [ "procuro" ], "region": null, "budget": 2500 }

Examples

• Extract a page to Markdown from the CLI: command completed successfully

  Source: README.md: Quick Start & CLI Usage

  Input: https://example.com --mode fast

  Expected: Markdown text of the page

  Command: <guest-path> run cli.ts extract https://example.com --mode fast

  Observed: This domain is for use in documentation examples without needing permission. This is not a service; avoid relying on it for testing and monitoring purposes.

• Discover sitemaps for a domain: command completed successfully

  Source: README.md: Quick Start & CLI Usage

  Input: https://example.com --max-urls 5

  Expected: JSON listing the host and sitemaps found

  Command: <guest-path> run cli.ts map https://example.com --max-urls 5

  Observed: { "host": "example.com", "sitemapsFound": [ "https://example.com/sitemap.xml" ], "totalDiscovered": 0, "urls": [] }

• Lint copy for AI slop: command completed successfully

  Source: README.md: Quick Start & CLI Usage

  Input: No cenário atual, uma solução revolucionária

  Expected: JSON with isSlop true

  Command: <guest-path> run cli.ts antislop 'No cenário atual, uma solução revolucionária'

  Observed: ed_word", "matched": "No cenário atual", "rule": "Abertura clichê de IA (throat-clearing)", "suggestion": "Vá direto ao ponto ou ao fato concreto", "index": 0 }, { "category": "banned_word", "matched": "revolucionária", "rule": "Hipérbole vazia sem dados comprobatórios", "suggestion": "Descreva o resultado específico em números ou tempo economizado", "index": 30 } ], "metrics": { "wordCount": 6, "concreteNumbersCount": 0, "sentencesCount": 1, "averageSentenceLength": 6, "hasConcreteGrounding": false } }

Local or hosted: local

Run the LookaCrawler CLI extract command and the extract_web_content MCP tool against a real page

pwd; ls -la; id -u; python3 --version; cat README.md 2>/dev/null | head -c 6000; echo; echo CDP=$CDP_URL; curl -s -m 10 -i $CDP_URL/json/version | head -20
cd <guest-path>; sed -n '1,400p' README.md | tail -c +6000 | head -c 7500
cd <guest-path>; cat package.json; ls .coldpass; which bun node npm; ls .github/workflows 2>/dev/null; git status 2>&1 | head -2
node --version; npm --version; (curl -fsSL https://bun.sh/install | bash) 2>&1 | tail -5; ls ~/.bun/bin 2>/dev/null
export PATH=$HOME/.bun/bin:$PATH; bun --version; cd <guest-path> && bun install 2>&1 | tail -15
export PATH=$HOME/.bun/bin:$PATH; cd <guest-path> && timeout 120 bun run cli.ts extract https://example.com --mode fast 2>&1 | head -40; echo EXIT=${PIPESTATUS[0]}
export PATH=$HOME/.bun/bin:$PATH; cd <guest-path> && timeout 600 bun test 2>&1 | tail -15
cd <guest-path>; grep -n "registerTool\|server.tool(" index.ts | head -30; grep -n -A12 "name: \"extract_web_content\"\|'extract_web_content'\|\"extract_web_content\"" index.ts | head -40
cd <guest-path>; sed -n 50,75p index.ts
echo HOME=$HOME; command -v bun; cd <guest-path>; export PATH=$HOME/.bun/bin:$PATH; { echo '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"t","version":"1"}}}'; echo '{"jsonrpc":"2.0","method":"notifications/initialized"}'; echo '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"extract_web_content","arguments":{"url":"https://example.com","mode":"fast"}}}'; } | timeout 120 bun run index.ts 2>/dev/null | tail -c 1200
ls -la <guest-path>; cd <guest-path>; grep -rn -i "setInterval\|cron\|--once\|--now\|schedule" --include=*.ts . | grep -v node_modules | grep -v test | head -20; grep -n -i "cron\|schedul\|--once\|webhook" README.md | head
cd <guest-path>; B=<guest-path>; timeout 120 $B run cli.ts intent "Procuro um sofá até R$ 2.500" 2>&1 | head -c 1500; echo; echo ---; timeout 120 $B run cli.ts antislop "No cenário atual, uma solução revolucionária" 2>&1 | head -c 1500; echo; echo ---; timeout 200 $B run cli.ts map https://example.com --max-urls 5 2>&1 | head -c 1200; echo EXIT=$?
cd <guest-path> && cat > claims.json <<'EOF'
[
  {"kind":"claim","claim":"CLI extracts a page to Markdown","source":"bun run cli.ts extract https://news.ycombinator.com --mode fast","input":"https://example.com","expected":"Markdown text of the page","probe_kind":"cli","argv":["<guest-path>","run","cli.ts","extract","https://example.com","--mode","fast"],"stdin":"","expected_text":"documentation examples","cwd":"<guest-path>","env":{}},
  {"kind":"claim","claim":"MCP server exposes extract_web_content tool","source":"**Tools:** `extract_web_content`, `crawl_website`, `map_website`","input":"https://example.com","expected":"Markdown text returned by the tool","probe_kind":"mcp","argv":["<guest-path>","run","index.ts"],"tool":"extract_web_content","arguments":{"url":"https://example.com","mode":"fast"},"expected_text":"documentation examples","cwd":"<guest-path>","env":{}},
  {"kind":"claim","claim":"CLI scores buying intent of a text","source":"bun run cli.ts intent \"Procuro um sofá até R$ 2.500\"","input":"Procuro um sofá até R$ 2.500","expected":"JSON with isLead true","probe_kind":"cli","argv":["<guest-path>","run","cli.ts","intent","Procuro um sofá até R$ 2.500"],"stdin":"","expected_text":"\"isLead\": true","cwd":"<guest-path>","env":{}}
]
EOF
python3 -I -c "import json;json.load(open('claims.json'));print('ok')"
cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"mcp","argv":["<guest-path>","run","index.ts"],"cwd":"<guest-path>","tool":"extract_web_content","arguments":{"url":"https://example.com","mode":"fast"},"expected_text":"documentation examples","env":{}}
EOF
cat > examples.json <<'EOF'
[
  {"kind":"example","claim":"Extract a page to Markdown from the CLI","source":"README.md: Quick Start & CLI Usage","input":"https://example.com --mode fast","expected":"Markdown text of the page","argv":["<guest-path>","run","cli.ts","extract","https://example.com","--mode","fast"],"cwd":"<guest-path>","env":{},"expected_text":"documentation examples"},
  {"kind":"example","claim":"Discover sitemaps for a domain","source":"README.md: Quick Start & CLI Usage","input":"https://example.com --max-urls 5","expected":"JSON listing the host and sitemaps found","argv":["<guest-path>","run","cli.ts","map","https://example.com","--max-urls","5"],"cwd":"<guest-path>","env":{},"expected_text":"https://example.com/sitemap.xml"},
  {"kind":"example","claim":"Lint copy for AI slop","source":"README.md: Quick Start & CLI Usage","input":"No cenário atual, uma solução revolucionária","expected":"JSON with isSlop true","argv":["<guest-path>","run","cli.ts","antislop","No cenário atual, uma solução revolucionária"],"cwd":"<guest-path>","env":{},"expected_text":"\"isSlop\": true"}
]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected (cli.ts, index.ts, package.json scripts, README). No cron, scheduler, --once/--now, or webhook loop is documented. The only long-running items are the MCP stdio/SSE server (serve) and the Maps daemon (daemon start), which are request servers rather than scheduled cycles. setInterval in browser-manager.ts is an idle browser sweeper, not a product cycle.","checks":[]}
EOF
for f in probe.json examples.json cycles.json; do python3 -I -c "import json,sys;json.load(open('$f'));print('$f ok')"; done
cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run the LookaCrawler CLI extract command and the extract_web_content MCP tool against a real page","operation_scope":"Pinned commit bc5ce110f8b52b00a474343105c40c0de0d86fb9 in a fresh Ubuntu VM; Bun 1.4.4 runtime; public internet access to example.com. Google Maps engine (maps/gtm/intel/daemon) not built and not exercised.","steps":["curl -fsSL https://bun.sh/install | bash","bun install (in <guest-path>)","bun run cli.ts extract https://example.com --mode fast","bun test (372 tests: 369 pass, 3 skip, 0 fail)","bun run index.ts (stdio MCP) tools/call extract_web_content {url: https://example.com}"],"deviations":["README says Bun 1.1+ but does not name an installer; installed Bun 1.4.4 with the official bun.sh install script (curl|sh), which put bun in <guest-path>; bun was not on PATH so saved argv uses that absolute path.","Workspace is not a git repository; no git metadata was needed for the operation.","Maps engine (go build, build:maps) skipped: not required for extract/CLI/MCP operations and needs Go 1.26+."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None for the tested operations. Note: bun is not on PATH after the curl installer; add it to PATH or use an absolute path."}
EOF
python3 -I -c "import json;json.load(open('report.json'));print('ok')"; cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60