Running a tool in a Docker container provides isolation, but it is not a complete security boundary. It's a mitigant, not a substitute for code review. A containerized tool can still exfiltrate secrets via network calls, exhaust host resources, or, if run with excessive privileges, break out.

For a Python web scraper, your audit must focus on three things: data egress, input validation, and dependency trust. Look for any outbound network calls besides the target domain - a `requests.post` to an unknown URL is a major red flag. Check how it handles malformed HTML; does it use `eval()` or `exec()` on any fetched content? Finally, audit the `requirements.txt` or `pyproject.toml`. A single malicious or compromised dependency can compromise your entire pipeline.

My personal baseline is to run a static analysis tool like `bandit` first, then manually trace the flow of any user-controlled data and credentials. Assume the agent will use the tool in unexpected ways, so the tool must be robust against any input permutation. If it can't be, its capability must be restricted via a strict allow-list at the agent orchestration layer.