building-full-social-audit-for-brand

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:24 AM UTC
• Version: 1.0.0

Overview

This social-audit skill is not plainly malicious, but it needs review because it handles an Apify credential unsafely in examples and overstates its multi-platform coverage.

Review before installing. Use this only if you are comfortable sending brand and social-account queries plus scraped results through Apify. Avoid the REST examples as written; prefer an Authorization header or a safer official client, keep APIFY_TOKEN out of prompts/logs/source files, and use a narrowly scoped token. Expect the documented workflow to be Twitter-focused unless the missing per-platform steps are added.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:84

Finding

Apify API Token Exposed in URL Query Strings

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 84–91
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: Medium

Vulnerable Code

bash

curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"searchTerms": "@[BRAND_HANDLE]" (run per platform), "maxItems": 100}'

Wait for SUCCEEDED. Fetch dataset:

bash

curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"

Technical Analysis

The REST fallback places the APIFY_TOKEN credential directly in URL query strings. Although the requests use HTTPS and communicate with the declared Apify service, HTTPS does not prevent the complete URL from being exposed at endpoints or in operational metadata.

After shell expansion, the token may appear in shell history, process or command telemetry, debugging output, reverse-proxy and server access logs, monitoring platforms, or copied command transcripts. Systems with broader access to logs than to secrets can therefore unintentionally disclose the credential.

Authentication to Apify is necessary for the Skill's declared functionality, but transmitting the credential as a query parameter is not the least-exposure method. The token should be carried in Apify's supported authorization header and excluded from logged URLs.

Attack Path

1. A user follows the documented REST fallback with APIFY_TOKEN set in the environment.
2. The shell expands $APIFY_TOKEN into the command's URL.
3. The authenticated URL is retained in shell history, command telemetry, process monitoring, debugging output, or HTTP infrastructure logs.
4. An attacker or lower-privileged operator obtains access to one of those records.
5. The attacker extracts the token from the token query parameter.
6. The attacker replays the token against Apify APIs.

...[truncated 585 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the token query parameter from every documented API URL.

2. Pass the credential through Apify's supported authorization header:

   bash

   curl -X POST \
     "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs" \
     -H "Authorization: Bearer $APIFY_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{"searchTerms":"@[BRAND_HANDLE]","maxItems":100}'
   
   curl \
     "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items" \
     -H "Authorization: Bearer $APIFY_TOKEN"
   

3. Avoid verbose request logging, shell tracing, or diagnostic output that could print authorization headers.

4. Recommend narrowly scoped tokens with only the permissions required to run the intended Actors and retrieve their results.

5. Rotate any token previously used through the documented query-string commands if those commands may have been retained in logs or command history.

6. Redact authentication parameters and headers from application, proxy, telemetry, and CI/CD logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest states the skill builds an audit across major platforms and explicitly names Twitter, Instagram, TikTok, and YouTube. However, the actual workflow and all runnable examples invoke only apidojo/twitter-user-scraper, with no corresponding execution steps for Instagram, TikTok, or YouTube, so the implemented behavior falls materially short of the claimed cross-platform audit.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill instructs use of an APIFY_TOKEN and third-party scraping services without warning about credential sensitivity, data sharing, retention, or least-privilege handling. In practice, this can lead users to paste or expose secrets insecurely and send brand/account-related data to an external provider without informed consent or governance review.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest promises brand-level audit outputs such as per-platform metrics, content mix, posting frequency, and overall brand health score. Instead, the documented inputs are narrowly tailored to Twitter account and tweet scraping, including follower/following extraction, retweeter extraction, Twitter handles, and Twitter user IDs, which indicates a different operational focus than a comprehensive multi-platform brand audit.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The inline documentation states "searchTerms": "@[BRAND_HANDLE]" (run per platform), implying a repeated multi-platform process. But the surrounding examples and actor references are exclusively to apidojo~twitter-user-scraper, which contradicts the claim that the workflow is being performed per platform.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The documented REST fallback sends data to an external third-party endpoint and includes the API token directly in the request URL. External transmission may be expected for this skill, but placing secrets in URLs is dangerous because URLs are commonly logged by shells, proxies, telemetry, browser history, and server infrastructure, increasing the chance of credential leakage.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

REST API fallback:

bash

curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"searchTerms": "@[BRAND_HANDLE]" (run per platform), "maxItems": 100}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

REST API fallback:

bash

curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"searchTerms": "@[BRAND_HANDLE]" (run per platform), "maxItems": 100}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

Fetching dataset items from the external Apify endpoint again places the token in the URL and retrieves scraped results over a third-party service. Even if this is intended functionality, it increases exposure of both credentials and collected data through logs and intermediary systems, especially in automated environments.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

Wait for SUCCEEDED. Fetch dataset:

bash

curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"

Step 3: Classify Results

Static analysis

No suspicious patterns detected.