ClawHub
Back to skill

Security audit

finding-instagram-ugc-creators-for-brands

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Instagram creator-discovery workflow that uses Apify as expected, with privacy handling caveats for scraped profile data.

Before installing, make sure you are comfortable using Apify and an APIFY_TOKEN for Instagram scraping, and treat exported creator lists as third-party profile data that should be stored and shared carefully and in line with applicable platform terms and privacy requirements.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST   "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{
    "keywords": ["#skincarereviews", "#skincareobsessed", "#honestskincarereviews"],
    "maxItems": 100
  }'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST   "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{
    "keywords": ["#skincarereviews", "#skincareobsessed", "#honestskincarereviews"],
    "maxItems": 100
  }'
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low
Confidence
79% confidence
Finding
This markdown file includes commands that write scraped creator data to local files, but it does not provide any user-facing warning about data handling, privacy, or retention. Under the markdown-specific warning rule, behaviors affecting user data or third-party profile data should be disclosed when the skill describes them.

Static analysis

No suspicious patterns detected.