ClawHub
Back to skill

Security audit

finding-food-bloggers-and-creators

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Apify-based social-media research workflow with expected third-party API use and no hidden persistence or destructive behavior.

Install only if you are comfortable sending search terms and scraped public social-media data to Apify/apidojo actors. Use a scoped Apify token where possible, avoid entering private campaign details as search terms, and verify any local scripts before running the optional run_actor.js examples because that helper is not included in this artifact.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback (run one at a time):**
```bash
# Instagram
curl -X POST "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{"keywords": ["#italianrecipes", "#italianfood"], "maxItems": 100}'

# TikTok
curl -X POST "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{"keywords": ["#italianrecipes", "#foodtok"], "maxItems": 200}'
Confidence
80% confidence
Finding
This finding reflects the hardcoded use of the external Apify API endpoint in the skill workflow, which means the skill is designed to export search terms and collected social-media-related data off-platform. In this context that is expected functionality, but it still represents a real data egress path that could expose user-supplied queries or operational metadata to a third party.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback (run one at a time):**
```bash
# Instagram
curl -X POST "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{"keywords": ["#italianrecipes", "#italianfood"], "maxItems": 100}'

# TikTok
curl -X POST "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{"keywords": ["#italianrecipes", "#foodtok"], "maxItems": 200}'
Confidence
80% confidence
Finding
This finding reflects the hardcoded use of the external Apify API endpoint in the skill workflow, which means the skill is designed to export search terms and collected social-media-related data off-platform. In this context that is expected functionality, but it still represents a real data egress path that could expose user-supplied queries or operational metadata to a third party.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback (run one at a time):**
```bash
# Instagram
curl -X POST "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{"keywords": ["#italianrecipes", "#italianfood"], "maxItems": 100}'

# TikTok
curl -X POST "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{"keywords": ["#italianrecipes", "#foodtok"], "maxItems": 200}'
Confidence
80% confidence
Finding
This finding reflects the hardcoded use of the external Apify API endpoint in the skill workflow, which means the skill is designed to export search terms and collected social-media-related data off-platform. In this context that is expected functionality, but it still represents a real data egress path that could expose user-supplied queries or operational metadata to a third party.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.