ClawHub
Back to skill

Security audit

finding-tiktok-creators-by-location

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward guide for using Apify to find TikTok creators by location, with privacy and platform-compliance caveats users should consider.

Install only if you are comfortable using Apify and providing an APIFY_TOKEN for TikTok location scraping. Use it only with public, lawfully accessible data, respect TikTok's terms and privacy laws, and avoid using location-derived creator data for harassment, stalking, or sensitive profiling.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill explicitly guides users to collect and rank TikTok creator profile and engagement data by location, but it provides no privacy, consent, platform-terms, or lawful-use warning. In a geo-targeted influencer discovery context, combining location with account metadata can facilitate profiling or misuse, so the omission materially increases compliance and privacy risk.

External Transmission

Medium
Category
Data Exfiltration
Content
### REST API fallback

```bash
curl -X POST "https://api.apify.com/v2/acts/apidojo~tiktok-location-scraper/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"startUrls": ["https://www.tiktok.com/place/Miami-Florida-123456"], "maxItems": 100}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### REST API fallback

```bash
curl -X POST "https://api.apify.com/v2/acts/apidojo~tiktok-location-scraper/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"startUrls": ["https://www.tiktok.com/place/Miami-Florida-123456"], "maxItems": 100}'
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.