ClawHub
Back to skill

Security audit

finding-youtube-micro-influencers

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for finding YouTube influencers, but it documents risky Apify token handling and contact-info collection without clear compliance guardrails.

Install only if you are comfortable sending YouTube search inputs to Apify and using the resulting contact data responsibly. Use a narrowly scoped Apify token, avoid the documented token-in-URL REST fallback where possible, prefer safer authenticated tooling, and ensure any outreach complies with YouTube terms, privacy laws, and anti-spam rules.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:114
Finding

Apify API Token Exposed in URL Query String

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 114
Vulnerability Type: Credential exposure through a URL query parameter
Risk Level: Medium

Vulnerable Code:

bash
"https://api.apify.com/v2/acts/apidojo~youtube-scraper/runs?token=$APIFY_TOKEN" \

Technical Analysis

The documented REST fallback places APIFY_TOKEN directly in the request URL. When the shell expands the environment variable, the resulting secret becomes part of the command argument and URL.

URL query strings may be recorded by shell history, process-monitoring tools, terminal session capture, HTTP clients, proxies, observability systems, and server access logs. This gives the credential a broader exposure surface than passing it through a supported authorization header. Quoting the URL prevents shell word splitting but does not prevent token disclosure.

Attack Path

  1. A user follows the documented REST fallback while APIFY_TOKEN is set.
  2. The shell expands $APIFY_TOKEN into the URL supplied to curl.
  3. The expanded URL may be captured by local process inspection, terminal auditing, proxy telemetry, or HTTP access logging.
  4. An attacker with access to one of those data sources extracts the token.
  5. The attacker reuses the token to authenticate to Apify APIs within the token's granted permissions.

Impact Assessment

Successful exploitation could permit unauthorized use of the victim's Apify account capabilities within the exposed token's scope. Potential consequences include running actors, consuming paid platform resources, accessing resources available to the token, exhausting quotas, and incurring costs. This finding does not establish privilege beyond the permissions already assigned to the token.

Remediation
View remediation

Remediation Suggestions

  • Use Apify's supported HTTP authorization header rather than the token URL query parameter.
  • Ensure the token is read from a protected environment variable or secret manager and is never printed or embedded in generated URLs.
  • Disable verbose HTTP tracing in environments where authorization headers could be logged, and configure tooling to redact authentication data.
  • Use a narrowly scoped token with only the permissions required to run and retrieve results from the intended actor.
  • Rotate the token if the documented command has already been used in an environment where command arguments or URLs may have been retained.
  • Review shell history, proxy logs, CI logs, terminal recordings, and monitoring data for prior exposure, then remove or securely redact affected records where feasible.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill explicitly promises to return channel contact information for outreach, but provides no privacy, consent, or acceptable-use guidance. Even if the data is scraped from publicly visible YouTube pages, packaging it for prospecting increases the risk of privacy misuse, spam, and non-compliant outreach workflows.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

REST API fallback:

bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~youtube-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

REST API fallback:

bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~youtube-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "searchQuery": "[SEARCH_TERM]",

Static analysis

No suspicious patterns detected.