ClawHub
Back to skill

Security audit

scraping-instagram-users-by-keyword

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Instagram scraper, but it enables bulk collection and export of public contact details without enough guardrails or lawful-use guidance.

Review this carefully before installing. Use it only for lawful, authorized research, keep maxItems narrowly scoped, avoid exporting email or phone fields unless truly necessary, and account for Instagram rules and privacy obligations for any outreach or dataset building.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly advertises collection and export of Instagram profile metadata including public email addresses and phone numbers, but it provides no warning about privacy, consent, platform Terms of Service, or lawful use. This increases the risk that users will use the skill for bulk contact harvesting, outreach abuse, or other privacy-invasive processing without understanding the sensitivity of the exported data.

External Transmission

Medium
Category
Data Exfiltration
Content
### REST API fallback

```bash
curl -X POST "https://api.apify.com/v2/acts/apidojo~instagram-user-scraper/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"handles": ["natgeo"], "getFollowers": false, "maxItems": 50}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### REST API fallback

```bash
curl -X POST "https://api.apify.com/v2/acts/apidojo~instagram-user-scraper/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"handles": ["natgeo"], "getFollowers": false, "maxItems": 50}'
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.