ClawHub
Back to skill

Security audit

finding-food-bloggers-and-creators

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its stated creator-search purpose, but its example commands handle the Apify API token in a way that can expose credentials in logs or process listings.

Review before installing. Prefer the Apify MCP or commands that pass APIFY_TOKEN in an Authorization header, avoid putting tokens in URLs, use narrowly scoped tokens, and confirm where scraped creator data will be saved before using CSV or JSON output options.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:87
Finding

API Token Exposed in URL Query Parameters

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 87–90
Vulnerability Type: API credential exposure through command-line URL arguments
Risk Level: Medium

Vulnerable Code

bash
# Instagram
curl -X POST "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{"keywords": ["#italianrecipes", "#italianfood"], "maxItems": 100}'

# TikTok
curl -X POST "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{"keywords": ["#italianrecipes", "#foodtok"], "maxItems": 200}'

Technical Analysis

The documented fallback commands place APIFY_TOKEN in the request URL. When executed, the shell expands the variable into curl's command-line arguments. Although HTTPS encrypts the request in transit, it does not prevent disclosure through local process inspection, shell debugging, command telemetry, crash diagnostics, or infrastructure that records complete URLs. Apify-side access logs and intermediary proxy logs may also retain query strings.

An attacker with access to exposed process arguments or relevant logs could recover the bearer credential and submit authenticated requests independently.

Attack Path

  1. A user exports a valid APIFY_TOKEN and runs one of the documented fallback commands.
  2. The shell expands $APIFY_TOKEN into the URL passed as a curl process argument.
  3. A local user, monitoring agent, diagnostic system, proxy, or logging component captures the command line or complete request URL.
  4. The attacker extracts the token from the token query parameter.
  5. The attacker reuses the token against the Apify API until it expires or is revoked.

Impact Assessment

The attacker obtains the permissions assigned to the compromised Apify token. Depending on its scope, this may permit running actors, consuming paid platform resources, accessing associated run results or datasets, and ca ...[truncated 168 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove credentials from URL query parameters.
  • Pass the token through an authorization header supported by the Apify API, for example:
bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"keywords":["#italianrecipes","#italianfood"],"maxItems":100}'
  • Use narrowly scoped tokens with only the permissions required to run the specified actors.
  • Ensure command, proxy, application, and HTTP access logs redact authorization headers and credentials.
  • Rotate the token immediately if a query-string version may already have been logged.
  • Avoid enabling shell tracing while handling credentials, and prevent secrets from being written to shell history or diagnostic output.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

External Transmission

Medium
Category
Data Exfiltration
Confidence
72% confidence
Finding

This finding points to the same Apify REST API example and the presence of an external endpoint itself is security-relevant in this skill context because it instructs users to send query data to a remote service. The context makes it somewhat expected for the skill, but it is still a real external transmission path that should be disclosed and controlled.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

REST API fallback (run one at a time):

bash
# Instagram
curl -X POST "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{"keywords": ["#italianrecipes", "#italianfood"], "maxItems": 100}'

# TikTok
curl -X POST "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{"keywords": ["#italianrecipes", "#foodtok"], "maxItems": 200}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
72% confidence
Finding

This finding points to the same Apify REST API example and the presence of an external endpoint itself is security-relevant in this skill context because it instructs users to send query data to a remote service. The context makes it somewhat expected for the skill, but it is still a real external transmission path that should be disclosed and controlled.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

REST API fallback (run one at a time):

bash
# Instagram
curl -X POST "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{"keywords": ["#italianrecipes", "#italianfood"], "maxItems": 100}'

# TikTok
curl -X POST "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{"keywords": ["#italianrecipes", "#foodtok"], "maxItems": 200}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
72% confidence
Finding

The TikTok curl example is another explicit third-party data transmission to Apify and similarly embeds the token in the URL. Even though the skill's purpose is to use external scrapers, this remains a material security concern because credentials and request contents may be exposed through logging or mishandled in automated agent execution.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

curl -X POST "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs?token=$APIFY_TOKEN" -H "Content-Type: application/json" -d '{"keywords": ["#italianrecipes", "#italianfood"], "maxItems": 100}'

TikTok

curl -X POST "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN" -H "Content-Type: application/json" -d '{"keywords": ["#italianrecipes", "#foodtok"], "maxItems": 200}'

text

### Step 2: Score Per Platform

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill explicitly recommends commands that save scraped results to local CSV/JSON files, but it does not warn the user that executing those commands will write data to disk. In an agent setting, undisclosed file-writing behavior can create privacy, persistence, and workspace hygiene issues, especially if scraped creator data is stored automatically in shared or sensitive environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.