ClawHub
Back to skill

Security audit

finding-youtube-micro-influencers

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Apify-based YouTube influencer search workflow, with privacy care needed for contact information and exported results.

Install only if you are comfortable using Apify for YouTube scraping and sending the requested search inputs to Apify. Use contact information only where lawful and appropriate, follow privacy and anti-spam rules, protect APIFY_TOKEN, and keep exported contact lists out of public repos or shared folders.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill explicitly promises to return influencer contact information gathered from scraped sources, but provides no guidance on lawful collection, data minimization, consent expectations, or responsible handling of personal/business contact data. This creates a privacy/compliance risk because users may collect and process email addresses or other contact details at scale without safeguards, especially for outreach or profiling use cases.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~youtube-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~youtube-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "searchQuery": "[SEARCH_TERM]",
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low
Confidence
82% confidence
Finding
The skill recommends saving scraped results to local CSV/JSON files and the dataset may include contact information, but it does not warn that these files can persist sensitive or regulated data on disk. This increases the chance of accidental exposure through insecure storage, sharing, backups, or repository commits.

Static analysis

No suspicious patterns detected.