ClawHub
Back to skill

Security audit

monitoring-tiktok-mentions-of-brand

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says: it sends TikTok brand-monitoring inputs to Apify/Apidojo and summarizes public TikTok results, with no hidden local access or persistence found.

Install only if you are comfortable sending TikTok search terms, hashtags, and URLs to Apify/Apidojo. Do not include confidential campaign names, regulated data, secrets, or highly sensitive crisis terms unless your organization approves that third-party processing, and prefer bounded maxItems values to control cost and data volume.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill routes user-supplied brand-monitoring queries to a third-party service (Apify/Apidojo), but the description does not clearly disclose that operational inputs will be transmitted off-platform. This creates a privacy and data-governance risk because users may enter sensitive campaign, competitor, or crisis-monitoring terms without realizing they are being shared with an external processor.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST   "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{
    "keywords": ["#[brand]", "#[brand]review", "#[brand]honest"],
    "maxItems": 200
  }'
Confidence
95% confidence
Finding
The skill explicitly sends input data to the Apify API, including search keywords and potentially sensitive brand-monitoring terms. In context this external transmission is core functionality rather than covert exfiltration, but it is still security-relevant because user data and business intelligence leave the local environment and are processed by a third party.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST   "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{
    "keywords": ["#[brand]", "#[brand]review", "#[brand]honest"],
    "maxItems": 200
  }'
Confidence
95% confidence
Finding
The skill explicitly sends input data to the Apify API, including search keywords and potentially sensitive brand-monitoring terms. In context this external transmission is core functionality rather than covert exfiltration, but it is still security-relevant because user data and business intelligence leave the local environment and are processed by a third party.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.