ClawHub
Back to skill

Security audit

extracting-youtube-comments-for-research

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate YouTube comment research purpose, but it relies on a mutable third-party Apify actor and documents unsafe token handling.

Install only if you are comfortable sending YouTube targets and scraping parameters to Apify/apidojo. Use a dedicated limited Apify token, avoid the REST example that puts the token in the URL, set explicit collection limits, and verify the exact Apify actor before running.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:59
Finding

Unpinned Third-Party Apify Actor Creates a Mutable Supply-Chain Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16 and 59-99
Vulnerability Type: Unpinned third-party remote component
Risk Level: Medium

Vulnerable Code

yaml
metadata:
  author: apidojo
  version: "1.0"
  apify-actor: apidojo/youtube-scraper
bash
# Quick answer (prints table to chat)
node scripts/run_actor.js \
  --actor "apidojo~youtube-comments-scraper" \
  --input '{"param": "value"}'

# Save as CSV
node scripts/run_actor.js \
  --actor "apidojo~youtube-comments-scraper" \
  --input '{"param": "value"}' \
  --output YYYY-MM-DD_results.csv --format csv

# Save as JSON
node scripts/run_actor.js \
  --actor "apidojo~youtube-comments-scraper" \
  --input '{"param": "value"}' \
  --output YYYY-MM-DD_results.json --format json
text
Tool: apify:run-actor
Actor: "apidojo~youtube-comments-scraper"
Input:
{
  "startUrls": [{"url": "[VIDEO_URL_1]"}, {"url": "[VIDEO_URL_2]"}],
  "type": "comments",
  "maxComments": 500
}
bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~youtube-comments-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"startUrls": [{"url": "[VIDEO_URL]"}], "type": "comments", "maxComments": 500}'

Technical Analysis

The workflow delegates data processing to an externally maintained Apify actor identified only by its mutable actor name. It does not pin a reviewed actor build, version, or immutable revision. Consequently, the implementation executed by users may change after this Skill has been audited.

There is also an identifier inconsistency: the metadata declares apidojo/youtube-scraper, while all execution examples invoke apidojo~youtube-comments-scraper. This discrepancy weakens provenance verification and may cause reviewers or users to validate a different component from the one actually executed.

This is a supply-chain risk rather than proof th ...[truncated 1473 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the actor to an immutable, reviewed build or version instead of invoking only its mutable name.
  2. Record the expected actor build identifier, publisher, input schema, output schema, and review date in the Skill metadata.
  3. Reconcile apidojo/youtube-scraper with apidojo~youtube-comments-scraper so metadata and execution examples refer to exactly the same reviewed component.
  4. Validate actor output against a strict schema before using it in downstream analysis.
  5. Use a dedicated, least-privilege Apify token and configure account spending or usage limits.
  6. Review actor changes before updating the pinned build and document a controlled upgrade procedure.
  7. Clearly disclose that target URLs, research inputs, and resulting data are processed by a third-party remote service.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:94
Finding

Apify API Token Is Passed Through a URL Query Parameter

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 94-100
Vulnerability Type: Credential exposure through a command-line URL
Risk Level: Medium

Vulnerable Code

bash
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~youtube-comments-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"startUrls": [{"url": "[VIDEO_URL]"}], "type": "comments", "maxComments": 500}'
text

### Technical Analysis

The fallback command interpolates `APIFY_TOKEN` directly into the request URL. After shell expansion, the credential becomes part of the `curl` process's command-line arguments. Depending on the operating system and environment, command-line arguments may be visible to other local processes or users through process inspection facilities.

URLs may also be captured by debugging output, shell tracing, proxy infrastructure, gateway logs, monitoring products, or error-reporting systems. Although HTTPS protects the URL while it is transported over the network, it does not prevent local process inspection or logging at endpoints and authorized intermediaries.

### Attack Path

1. The user exports `APIFY_TOKEN` and runs the documented REST fallback command.
2. The shell expands `$APIFY_TOKEN` into the URL supplied as a command-line argument to `curl`.
3. A local user, monitoring agent, diagnostic collector, or improperly configured logging component captures the process arguments or complete request URL.
4. The attacker extracts the token from the `token` query parameter.
5. The attacker submits requests to Apify using the stolen token until it is revoked or expires.
6. The attacker can perform operations allowed by that token, potentially including starting actors, accessing authorized run data, or consuming account resources.

### Impact Assessment

Successful exploitation exposes the Apify bearer credential. The resulting privileges a
...[truncated 448 chars]
Remediation
View remediation

Remediation Suggestions

  1. Use Apify's supported HTTP authorization header instead of a URL query parameter. For example:

    bash
    curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~youtube-comments-scraper/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"startUrls": [{"url": "[VIDEO_URL]"}], "type": "comments", "maxComments": 500}'

  2. Verify the exact authorization syntax against current Apify documentation before publishing the replacement.

  3. Use a dedicated token with the minimum permissions needed to launch the intended actor.

  4. Rotate any token that may previously have appeared in process captures, request logs, shell traces, or monitoring records.

  5. Disable shell tracing while handling credentials and ensure scripts do not print authorization headers.

  6. Configure log redaction for authorization values and legacy token query parameters.

  7. Apply account usage and spending limits to reduce the impact of credential compromise.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill is presented as narrowly focused on YouTube comment research, but the documented inputs support broader discovery and scraping across channels, playlists, search results, trending content, and keywords. This scope mismatch can cause users or downstream agents to invoke materially broader collection behavior than expected, increasing data collection, compliance, and consent risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documented customMapFunction allows arbitrary JavaScript transformation of output objects, which materially expands the skill from a simple data-extraction tool into one that may execute user-supplied code in the external actor environment. Because this capability is not reflected in the skill description, users may unknowingly permit code execution-like behavior and data manipulation beyond the stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The workflow instructs sending YouTube URLs and extracted comment data to Apify-operated services, but the skill description does not clearly warn users about this third-party transmission. This undermines informed consent and can create privacy, contractual, or policy issues when users assume processing is local or limited to the agent environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The REST fallback explicitly transmits user-provided video URLs and associated scraping instructions to an external API endpoint. External transmission is expected for this skill’s function, but it remains security-relevant because it exposes user inputs and retrieved data to a third-party processor and may violate expectations if not clearly disclosed.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

REST API fallback:

bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~youtube-comments-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"startUrls": [{"url": "[VIDEO_URL]"}], "type": "comments", "maxComments": 500}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

REST API fallback:

bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~youtube-comments-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"startUrls": [{"url": "[VIDEO_URL]"}], "type": "comments", "maxComments": 500}'

Static analysis

No suspicious patterns detected.