T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:84- Finding
Apify API Token Exposed Through URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
scraping-instagram-profile-data
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed Apify-based Instagram scraping workflow, but it has review-worthy scope and credential-handling concerns.
Review before installing. Use a dedicated, least-privilege Apify token, avoid the documented token-in-URL curl fallback when possible, confirm what account or URL lists will be sent to Apify, set explicit item limits, and avoid customMapFunction unless you trust the remote actor and transformation code.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:73- Finding
Unpinned Mutable Third-Party Apify Actor
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger/description language is broad and activation boundaries are not clearly constrained, which raises the risk that the skill will be invoked for loosely related requests. In an agent setting, ambiguous routing can lead to unintended third-party scraping and disclosure of queried account lists without sufficiently specific user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill does not clearly warn that Instagram usernames and query parameters are transmitted to Apify/apidojo, a third-party service. This is a privacy and transparency issue because account lists may be sensitive business intelligence, investigative targets, or personal data, and users may not realize they are being shared externally.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill metadata and prose position this as a profile-data scraper, but the documented inputs allow arbitrary Instagram URLs and time-bounded post scraping. This scope mismatch can cause the agent to collect broader content than the user intended, including non-profile resources and historical post data, increasing data collection and policy/compliance risk.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Allowing a user-supplied
customMapFunctionJavaScript transform in a scraping skill materially expands capability beyond simple data retrieval. Even if execution occurs on the third-party platform, it enables arbitrary code-like logic over scraped data and can be abused to bypass expected data-shaping constraints or introduce unsafe processing behavior.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 74% confidence
- Finding
This documents an external POST request that sends usernames to Apify for scraping. In this skill context the transmission is expected, but it is still security-relevant because it discloses user-supplied targets to a third party and uses a bearer token in the request URL, which can increase secret exposure through logs or shell history.
- Content
REST API fallback:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"usernames": ["handle1", "handle2"]}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
REST API fallback:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"usernames": ["handle1", "handle2"]}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 71% confidence
- Finding
Polling the actor run status sends the run identifier and API token to the third-party service. This is normal for the workflow, but still represents external communication and continues the practice of placing credentials in the URL, which can leak via logs or monitoring systems.
- Content
Save
idasRUN_ID. Poll untilstatus = SUCCEEDED:bash curl "https://api.apify.com/v2/actor-runs/$RUN_ID?token=$APIFY_TOKEN" | grep '"status"'Fetch results:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Fetching dataset items from Apify is an external transmission of potentially sensitive scraped results and again exposes the API token in the request URL. If outputs include business/contact information or target-account data, this increases privacy and secret-handling risk if requests are logged or shared.
- Content
Fetch results:
bash curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN&format=json"Step 3: Handle Edge Cases
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The documentation says the skill performs bulk username-based profile export, but the declared input accepts generic Instagram URLs for unrelated page types. This inconsistency can mislead users and downstream agents into sending broader targets than expected, causing overcollection and unpredictable behavior.
- Content