ClawHub
Back to skill

Security audit

scraping-instagram-location-content

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for Instagram location scraping, but it enables location-based monitoring and creator profiling without enough guardrails for privacy, consent, or sensitive venues.

Review carefully before installing. Use it only for public Instagram location data, with a legitimate business purpose and compliance with Instagram terms, privacy law, and your organization’s policies. Avoid sensitive venues, private-person tracking, stalking, or unauthorized profiling, and be cautious when saving or sharing creator lists.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger description is broad enough to activate on many loosely related requests about Instagram, venues, events, influencers, or UGC collection. That increases the chance the skill runs without clear user intent boundaries, which can lead to over-collection of social media data and profiling-oriented use cases such as identifying creators tied to a location.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill encourages gathering public social media posts, identifying repeat visitors, and flagging creators for outreach, but it provides no warning about privacy, platform terms, consent, or responsible handling of user-generated content. In context, that omission makes misuse more likely because the workflow operationalizes location-based monitoring and influencer identification without any guardrails.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~instagram-location-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~instagram-location-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "locationIds": ["[LOCATION_ID]"],
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.