ClawHub
Back to skill

Security audit

finding-tiktok-ugc-creators-for-brands

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Apify-based TikTok creator search workflow, but users should handle the Apify token carefully.

Install only if you are comfortable sending TikTok search terms and profile URLs to Apify. Store APIFY_TOKEN as a secret, avoid pasting live tokens into shared chats or screenshots, prefer MCP or header-based authentication over URL query tokens, and set reasonable maxItems limits to control cost and data volume.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Confidence
83% confidence
Finding
This markdown file applies to SQP-2, and it directs users to set a sensitive credential in the environment. While the token is required for the skill, the document does not include any warning about protecting the token, avoiding sharing logs/commands, or handling the credential safely.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The REST example places APIFY_TOKEN directly in the request URL query string. Tokens in URLs are more likely to be exposed through shell history, logs, process listings, proxy logs, analytics, and copied command snippets, creating avoidable credential leakage risk.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST   "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{
    "keywords": ["#skincarereviews", "#skincarehaul"],
    "maxItems": 200
  }'
Confidence
88% confidence
Finding
This command sends user-supplied search terms and an authentication token to an external third-party service. External transmission is expected for this skill, but the example increases risk by embedding the token in the URL, which can leak credentials beyond the intended recipient.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST   "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{
    "keywords": ["#skincarereviews", "#skincarehaul"],
    "maxItems": 200
  }'
Confidence
88% confidence
Finding
This command sends user-supplied search terms and an authentication token to an external third-party service. External transmission is expected for this skill, but the example increases risk by embedding the token in the URL, which can leak credentials beyond the intended recipient.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST   "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{
    "keywords": ["#skincarereviews", "#skincarehaul"],
    "maxItems": 200
  }'
Confidence
88% confidence
Finding
This command sends user-supplied search terms and an authentication token to an external third-party service. External transmission is expected for this skill, but the example increases risk by embedding the token in the URL, which can leak credentials beyond the intended recipient.

Static analysis

No suspicious patterns detected.