ClawHub
Back to skill

Security audit

finding-gaming-content-creators

Security checks across malware telemetry and agentic risk

Overview

This skill clearly uses Apify TikTok and YouTube scrapers to find gaming creators, with disclosed token, network, and optional export behavior.

Install this only if you are comfortable using an Apify token to run TikTok and YouTube scraper actors and, when exporting results, choose file paths deliberately and handle creator contact or engagement data responsibly.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The manifest says the skill finds gaming content creators and returns creator-level fields like handle, platform, subscriber count, average views, game focus, and engagement signals. However, the documented inputs are post-scraping parameters for TikTok URLs/posts and include a generic `customMapFunction` JavaScript transform, indicating the skill exposes lower-level scraping and arbitrary output transformation behavior rather than a narrowly scoped creator-discovery interface.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
# TikTok
curl -X POST "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{"keywords": ["#valorant", "#valorantclips", "#gamingtiktok"], "maxItems": 300}'

# YouTube
curl -X POST "https://api.apify.com/v2/acts/apidojo~youtube-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{"searchKeywords": ["valorant gameplay", "valorant tips 2026"], "maxResults": 50}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
# TikTok
curl -X POST "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{"keywords": ["#valorant", "#valorantclips", "#gamingtiktok"], "maxItems": 300}'

# YouTube
curl -X POST "https://api.apify.com/v2/acts/apidojo~youtube-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{"searchKeywords": ["valorant gameplay", "valorant tips 2026"], "maxResults": 50}'
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
# TikTok
curl -X POST "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{"keywords": ["#valorant", "#valorantclips", "#gamingtiktok"], "maxItems": 300}'

# YouTube
curl -X POST "https://api.apify.com/v2/acts/apidojo~youtube-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{"searchKeywords": ["valorant gameplay", "valorant tips 2026"], "maxResults": 50}'
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Low
Confidence
80% confidence
Finding
The manifest presents the skill as returning a creator outreach list, which implies producing results to the caller. The documentation additionally instructs use of `scripts/run_actor.js` to save outputs as CSV or JSON files locally, which is extra behavior beyond simply finding and returning gaming creators.

Missing User Warnings

Low
Confidence
85% confidence
Finding
The markdown explicitly recommends a helper script that 'handles waiting, output, and file saving automatically' and shows examples writing CSV and JSON files. While the examples imply file creation, there is no clear warning section telling users that the skill may save data to local files or advising them to choose output paths carefully.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.