T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:86- Finding
Apify API Token Exposed in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
scraping-instagram-posts-by-hashtag
Security checks for vulnerabilities and agentic risk
Overview
This skill is coherently for Instagram hashtag scraping through Apify, but it documents insecure token-in-URL API commands and gives limited guidance on third-party processing and scraped social data handling.
Review before installing. Use this only for data you are allowed to collect, set small maxItems limits, protect any CSV/JSON outputs, and replace the documented REST examples with header-based authentication such as an Authorization bearer token rather than putting APIFY_TOKEN in the URL.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger language is broad enough to match common social-media research or download requests without clearly signaling that the skill will invoke a third-party scraping service. Over-broad activation increases the chance of unintended use, especially for requests involving Instagram content collection that may carry legal, privacy, or policy implications.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs users to run an external Apify actor and optionally save retrieved data to local files, but it does not clearly warn that user-supplied hashtags and resulting Instagram metadata are transmitted to and processed by a third-party service. This omission undermines informed consent and can expose sensitive research targets, account metadata, or stored outputs unexpectedly.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
This command sends input data and an authentication token to an external API endpoint, which is a real data-transmission boundary. While expected for the skill's functionality, it is still security-relevant because it exposes user queries and operational credentials to a third party and could leak the token via command history, logs, or shell process inspection.
- Content
REST API fallback:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~instagram-hashtag-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"keywords": ["tag1"], "maxItems": 100}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
REST API fallback:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~instagram-hashtag-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"keywords": ["tag1"], "maxItems": 100}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
Polling the run status against Apify is another external network action involving the actor run identifier and API token. Although operationally normal, it still extends third-party visibility into usage patterns and again risks token exposure through shell history or process listings.
- Content
Save
idasRUN_ID. Poll untilstatus = SUCCEEDED:bash curl "https://api.apify.com/v2/actor-runs/$RUN_ID?token=$APIFY_TOKEN" | grep '"status"'Fetch results:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
Fetching dataset items from the external API transfers scraped Instagram metadata from a third-party service back to the local environment, potentially including author handles, captions, mentions, and media URLs. This is expected behavior for the skill, but it is still sensitive because it facilitates collection and local storage of third-party data without a clear disclosure or handling guidance.
- Content
Fetch results:
bash curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN&format=json"Step 3: Handle Edge Cases
Static analysis
No suspicious patterns detected.