ClawHub
Back to skill

Security audit

scraping-instagram-location-posts

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Apify Instagram-location scraping skill, with the main risk being careful handling of the Apify API token.

Install only if you are comfortable using an Apify token to run the specified Instagram scraper. Prefer the Apify MCP/client or header-based authentication when available, avoid sharing logs that contain authenticated URLs, and consider setting maxItems to control data volume and account usage.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill instructs users to use APIFY_TOKEN for API access but does not warn that placing bearer-like secrets in command lines, URLs, or shell-invoked examples can expose them through shell history, process listings, terminal logs, CI logs, and proxy/server logs. In this skill's context, the risk is real because later examples explicitly append the token to request URLs, making accidental credential leakage more likely.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~instagram-location-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"locationIds": ["<LOCATION_ID>"], "maxItems": 100}'
Confidence
96% confidence
Finding
This example transmits APIFY_TOKEN in the query string of a curl command. Query-string secrets are commonly captured in shell history, browser/history substitutes, process lists, reverse proxies, monitoring tools, and server access logs, so the token may be exposed beyond the intended recipient.

External Transmission

Medium
Category
Data Exfiltration
Content
Save `id` as `RUN_ID`. Poll until `status = SUCCEEDED`:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID?token=$APIFY_TOKEN" | grep '"status"'
```

Fetch results:
Confidence
95% confidence
Finding
The polling example again places APIFY_TOKEN in the request URL, creating repeated opportunities for credential exposure in logs, terminal history, and observability systems. Repeated inclusion across multiple steps increases the chance that users operationalize an insecure pattern and leak reusable API credentials.

External Transmission

Medium
Category
Data Exfiltration
Content
Save `id` as `RUN_ID`. Poll until `status = SUCCEEDED`:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID?token=$APIFY_TOKEN" | grep '"status"'
```

Fetch results:
Confidence
95% confidence
Finding
The polling example again places APIFY_TOKEN in the request URL, creating repeated opportunities for credential exposure in logs, terminal history, and observability systems. Repeated inclusion across multiple steps increases the chance that users operationalize an insecure pattern and leak reusable API credentials.

External Transmission

Medium
Category
Data Exfiltration
Content
Save `id` as `RUN_ID`. Poll until `status = SUCCEEDED`:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID?token=$APIFY_TOKEN" | grep '"status"'
```

Fetch results:
Confidence
95% confidence
Finding
The polling example again places APIFY_TOKEN in the request URL, creating repeated opportunities for credential exposure in logs, terminal history, and observability systems. Repeated inclusion across multiple steps increases the chance that users operationalize an insecure pattern and leak reusable API credentials.

Static analysis

No suspicious patterns detected.