ClawHub
Back to skill

Security audit

finding-restaurant-brands-on-instagram

Security checks for vulnerabilities and agentic risk

Overview

This skill transparently uses Apify to find public Instagram restaurant accounts for outreach, with privacy and platform-compliance cautions but no hidden or disproportionate behavior in the artifact.

Before installing, confirm your use of Apify and Instagram data complies with platform terms, privacy law, and anti-spam or marketing rules. Limit collection to necessary public business information, set reasonable maxItems limits, and avoid processing personal or sensitive data unless you have a lawful basis.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill is explicitly designed to collect and export Instagram profile and engagement data for outreach, but it provides no guidance on legality, platform Terms of Service, consent, data minimization, or downstream marketing/privacy obligations. In a lead-generation context, that omission increases the likelihood of non-compliant scraping and processing of third-party personal or business profile data.

External Transmission

Medium
Category
Data Exfiltration
Content
### REST API fallback

```bash
curl -X POST "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"startUrls": ["https://www.instagram.com/explore/tags/restaurantowner/"], "maxItems": 100}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### REST API fallback

```bash
curl -X POST "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"startUrls": ["https://www.instagram.com/explore/tags/restaurantowner/"], "maxItems": 100}'
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.