finding-tiktok-shop-trending-products

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:18 AM UTC
• Version: 1.0.0

Overview

This skill is purpose-aligned, but its documented REST fallback handles the Apify API token in a riskier way than necessary.

Install only if you are comfortable using Apify for TikTok data collection. Prefer the Apify MCP or a helper that sends the token in an Authorization header, use a least-privilege Apify token, monitor Apify usage costs, and avoid running the documented REST fallback as written.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:87

Finding

Apify API Token Exposed in a URL Query Parameter

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 87-91
Vulnerability Type: Credential exposure through a URL query parameter
Risk Level: Medium

Vulnerable Code

bash

curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"keywords": ["#tiktokmademebuyit", "#skincaretiktokshop"], "maxItems": 300}'

Technical Analysis

The documented REST fallback places APIFY_TOKEN in the request URL. When the shell expands the environment variable, the resulting token becomes part of the command-line argument passed to curl.

Although HTTPS encrypts the URL while it is transmitted, URLs can still be exposed through local process inspection, HTTP client diagnostics, monitoring infrastructure, proxy logs, error reports, and server-side request or access logs. Systems commonly retain URLs for observability purposes, making query strings unsuitable for credentials.

The project contains only SKILL.md; no executable implementation is present. The referenced scripts/run_actor.js file is absent and could not be reviewed. This finding is therefore limited to the documented REST command.

Attack Path

1. A user exports a valid APIFY_TOKEN and executes the documented fallback command.
2. The shell expands $APIFY_TOKEN, placing its value in the URL supplied as a curl process argument.
3. A local process monitor, privileged local user, diagnostic collector, proxy, or URL-logging service records or observes the full URL.
4. An attacker with access to that record extracts the token from the token query parameter.
5. The attacker reuses the token against Apify APIs until the credential expires or is revoked.

Exploitation requires an attacker to have access to a system or service that can observe or retain the expanded command or request URL.

Impact Assessment

A disclosed token may permit unauthori ...[truncated 430 chars]

Remediation

View remediation

Remediation Suggestions

Remove the token from the URL and transmit it through an authorization header:

bash

curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"keywords": ["#tiktokmademebuyit", "#skincaretiktokshop"], "maxItems": 300}'

Apply the following additional controls:

1. Use a least-privilege Apify token limited to the capabilities required by this Skill.
2. Prevent secrets from being written to command output, debug logs, generated files, or error reports.
3. If a .env file is supported, exclude it from version control and restrict its filesystem permissions.
4. Rotate any token that may already have been used in a logged query-string URL.
5. Configure proxies and monitoring systems to redact authorization data and sensitive query parameters.
6. Add automated secret scanning and documentation linting to detect credentials passed through URLs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

REST API fallback:

bash

curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"keywords": ["#tiktokmademebuyit", "#skincaretiktokshop"], "maxItems": 300}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

REST API fallback:

bash

curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"keywords": ["#tiktokmademebuyit", "#skincaretiktokshop"], "maxItems": 300}'