T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:99- Finding
Apify API Token Exposed Through URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
finding-gaming-content-creators
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a normal Apify-based creator discovery guide, but it documents unsafe credential handling and an overbroad raw JavaScript mapping option.
Review before installing. Use a narrowly scoped Apify token, avoid the REST fallback examples unless changed to an Authorization header, do not commit .env files, and avoid allowing arbitrary customMapFunction JavaScript unless you explicitly trust the Apify actor and the transformation code.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documented customMapFunction allows arbitrary JavaScript to be supplied as input, which can enable code execution inside the scraping/transformation environment if honored by the underlying actor. That is far beyond the stated purpose of discovering gaming creators and creates a powerful injection surface for data exfiltration, environment access, or malicious output manipulation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest says the skill finds gaming content creators on TikTok and YouTube and returns creator-level fields like handle, platform, subscriber count, average views, game focus, and engagement signals. However, the documented inputs are largely TikTok post-scraper parameters such as startUrls, sortType, includeSearchKeywords, and customMapFunction, which do not align with a creator-listing interface and suggest materially different behavior than the stated skill purpose.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The skill explicitly sends user-provided search terms and API credentials to an external third-party service, Apify, via HTTP requests. External transmission is expected for this skill's purpose, but it still creates a real data-sharing boundary and exposes the risk of leaking sensitive query content or mishandling the token, especially because the token is placed in the URL where it may be logged by shells, proxies, or monitoring systems.
- Content
REST API fallback:
bash # TikTok curl -X POST "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN" -H "Content-Type: application/json" -d '{"keywords": ["#valorant", "#valorantclips", "#gamingtiktok"], "maxItems": 300}' # YouTube curl -X POST "https://api.apify.com/v2/acts/apidojo~youtube-scraper/runs?token=$APIFY_TOKEN" -H "Content-Type: application/json" -d '{"searchKeywords": ["valorant gameplay", "valorant tips 2026"], "maxResults": 50}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The skill explicitly sends user-provided search terms and API credentials to an external third-party service, Apify, via HTTP requests. External transmission is expected for this skill's purpose, but it still creates a real data-sharing boundary and exposes the risk of leaking sensitive query content or mishandling the token, especially because the token is placed in the URL where it may be logged by shells, proxies, or monitoring systems.
- Content
REST API fallback:
bash # TikTok curl -X POST "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN" -H "Content-Type: application/json" -d '{"keywords": ["#valorant", "#valorantclips", "#gamingtiktok"], "maxItems": 300}' # YouTube curl -X POST "https://api.apify.com/v2/acts/apidojo~youtube-scraper/runs?token=$APIFY_TOKEN" -H "Content-Type: application/json" -d '{"searchKeywords": ["valorant gameplay", "valorant tips 2026"], "maxResults": 50}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
curl -X POST "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN" -H "Content-Type: application/json" -d '{"keywords": ["#valorant", "#valorantclips", "#gamingtiktok"], "maxItems": 300}'
YouTube
curl -X POST "https://api.apify.com/v2/acts/apidojo~youtube-scraper/runs?token=$APIFY_TOKEN" -H "Content-Type: application/json" -d '{"searchKeywords": ["valorant gameplay", "valorant tips 2026"], "maxResults": 50}'
text ### Step 2: Score Creators
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
L025-L026 tell users to set an APIFY_TOKEN, and L096 reiterates that it may be stored in the environment or a .env file. The document does not include any caution about treating this token as sensitive, avoiding commits of .env files, or limiting exposure when using the skill.
- Content
Static analysis
No suspicious patterns detected.