discovering-tiktok-creators-by-niche

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:22 AM UTC
• Version: 1.0.0

Overview

The skill’s TikTok creator-discovery purpose is coherent, but it handles the Apify API token in a way that can expose a sensitive credential.

Review before installing. Use this only with a narrowly scoped Apify token, prefer an authorization header or MCP/secret-managed flow instead of URL query tokens, avoid putting sensitive campaign strategy in searches, and clean up exported creator CSV/JSON files when no longer needed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:97

Finding

Apify API Token Exposed in URL Query Strings

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 97 and 108
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: Medium

The documented curl commands place the APIFY_TOKEN secret directly in request URLs:

bash

curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "keywords": ["[hashtag1]", "[hashtag2]"],
    "shouldDownloadCovers": false
  }'

bash

curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"

Technical Analysis

Authentication with Apify is necessary for the Skill's declared TikTok creator-discovery functionality. However, transmitting the API token as a URL query parameter is an insecure credential-handling practice and exceeds the minimum exposure necessary for authentication.

When the shell expands $APIFY_TOKEN, the resulting secret-bearing URL may be exposed through:

• Process command-line inspection while curl is running.
• Shell history, depending on how users invoke or adapt the documented commands.
• HTTP access logs maintained by gateways, reverse proxies, or API infrastructure.
• Network monitoring and observability systems that record complete URLs.
• Debug output, terminal capture, support bundles, or command auditing facilities.
• Browser or tooling history if the URL is reused outside curl.

HTTPS protects the request in transit from ordinary network interception, but it does not prevent the URL from being recorded at endpoints or by local process-monitoring systems. The token is sent only to the declared api.apify.com service, so the audit found no evidence of intentional exfiltration to an unrelated domain.

Attack Path

1. A user configures a valid APIFY_TOKEN and follows the command documented in SKILL.md.
2. The shell expands $APIFY_TOKEN into the curl comm ...[truncated 1163 chars]

Remediation

View remediation

Remediation Suggestions

Use an HTTP authorization header instead of placing the token in the URL:

bash

curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "keywords": ["[hashtag1]", "[hashtag2]"],
    "shouldDownloadCovers": false
  }'

Retrieve dataset results using the same header-based authentication approach:

bash

curl \
  "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items" \
  -H "Authorization: Bearer $APIFY_TOKEN"

Additional hardening measures:

1. Ensure the token is never printed in normal, debug, or error output.
2. Store it in a dedicated secret manager where available.
3. If a .env file is used, exclude it from version control and restrict its filesystem permissions.
4. Issue a narrowly scoped token with only the permissions required to run the specified actors and retrieve their results.
5. Rotate any token that may already have appeared in logs, shell history, or monitoring systems.
6. Configure logging and observability systems to redact authorization credentials and legacy token query parameters.
7. Remove or sanitize historical records containing secret-bearing URLs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill requires an APIFY_TOKEN and directs the agent/user to send requests to Apify, but it provides no notice that credentials and query data will be transmitted to a third-party service. In a skill context, that omission can lead to unintended disclosure of user inputs, campaign targets, or operational secrets to an external processor without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This instruction explicitly transmits data to Apify over an external network call using APIFY_TOKEN, yet the skill does not require consent gating or data-sensitivity checks first. Even if expected for the workflow, external transmission of user-supplied search terms and account-scoped credentials is a real security concern when not clearly disclosed and controlled.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

If Apify MCP is not available:

bash

curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

If Apify MCP is not available:

bash

curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "keywords": ["[hashtag1]", "[hashtag2]"],

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

Fetching dataset items from Apify again sends authenticated requests to a third-party service and retrieves scraped creator data without any warning about external storage, transfer, or downstream handling. In this skill, the context makes the issue more significant because the workflow is explicitly built around collecting and ranking third-party profile data for outreach.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

Step 4: Fetch and Deduplicate Creators

bash

curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"

From the results, extract unique authorMeta.id values. Deduplicate — same creator often appears across hashtags. Sort by authorMeta.fans (follower count).

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill recommends saving scraped creator data to local CSV/JSON files but does not warn that this writes collected profile data to disk. That can create unintended persistence, broaden access to the data, and increase leakage risk on shared or unmanaged systems.

Content

No source excerpt is available for this finding.