ClawHub
Back to skill

Security audit

Analyzing TikTok Hashtag Performance

Security checks across malware telemetry and agentic risk

Overview

This skill uses Apify to scrape TikTok hashtag results for analytics, and its network/API behavior matches its stated purpose.

Install only if you are comfortable sending TikTok hashtags, search terms, URLs, and related scrape results to Apify under your Apify account. Keep APIFY_TOKEN secret, prefer MCP or a helper that injects credentials securely, and avoid pasting real tokens into commands, screenshots, logs, or shared terminals.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
93% confidence
Finding
The skill explicitly instructs users to transmit data to an external API and embeds the APIFY_TOKEN in a URL query string. Sending tokens in URLs is risky because URLs are commonly captured in shell history, logs, proxies, monitoring tools, and error messages, which can expose the credential and enable unauthorized use of the Apify account.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "keywords": ["[hashtag1]", "[hashtag2]", "[hashtag3]"]
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The skill requires an APIFY_TOKEN and sends TikTok query data to Apify, but it does not warn users that they are using a third-party service or that their queries and results may be transmitted and stored externally. This is primarily a transparency and privacy issue rather than a direct exploit, but it can lead to inadvertent disclosure of sensitive research topics or account-associated usage.

VirusTotal

52/52 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.