ClawHub
Back to skill

Security audit

finding-brand-ambassador-candidates

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says: it helps find brand ambassador candidates by sending brand-search inputs to Apify scrapers, but users should handle the Apify token carefully.

Install only if you are comfortable sending brand, hashtag, and creator research data to Apify. Set APIFY_TOKEN through a secure environment or secret manager, avoid pasting token-bearing curl commands into shared logs or transcripts, and prefer the MCP/helper workflow or an authorization-header pattern over putting tokens in URLs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill requires an APIFY_TOKEN and directs the user to invoke third-party Apify actors and REST endpoints, but it does not clearly warn that supplied search terms, result data, and authentication material are being sent to an external service. This is a real security/privacy weakness because users may unknowingly transmit business-sensitive brand research or misuse credentials in logs, shells, or shared environments.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
# Instagram
curl -X POST "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{"keywords": ["#[brand]", "#[brand]review"], "maxItems": 200}'
```

### Step 2: Score Ambassador Fit
Confidence
94% confidence
Finding
The curl example posts directly to api.apify.com and embeds the APIFY_TOKEN in the URL query string. Tokens in URLs are especially risky because they can be exposed through shell history, process listings, proxy logs, browser/history tooling, and monitoring systems, while the request also transmits user-supplied brand research data to an external provider.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
# Instagram
curl -X POST "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{"keywords": ["#[brand]", "#[brand]review"], "maxItems": 200}'
```

### Step 2: Score Ambassador Fit
Confidence
94% confidence
Finding
The curl example posts directly to api.apify.com and embeds the APIFY_TOKEN in the URL query string. Tokens in URLs are especially risky because they can be exposed through shell history, process listings, proxy logs, browser/history tooling, and monitoring systems, while the request also transmits user-supplied brand research data to an external provider.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.