ClawHub
Back to skill

Security audit

scraping-tiktok-comments

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward TikTok comment scraper that uses Apify as disclosed, with privacy considerations users should understand before running it.

Install this only if you are comfortable sending target TikTok URLs, run metadata, and scraped comment data to Apify/Apidojo under your Apify account. Use reasonable maxItems limits, avoid regulated or sensitive monitoring targets unless you have approval, and review Apify retention/deletion settings for actor runs and datasets.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill clearly routes user-supplied TikTok URLs and the resulting scraped comment data to Apify/Apidojo, but the description and usage guidance do not prominently warn users that a third-party processor will receive this data. This is a real transparency and data-handling issue because users may assume the action is local or first-party, especially when exporting datasets for research or monitoring.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tiktok-comments-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"videoUrls": ["<url>"], "maxItems": 200}'
Confidence
95% confidence
Finding
This command sends user-provided TikTok URLs and parameters to Apify's external API, which is an intentional external data transmission. In context, the transmission is necessary for the skill to function, but it still creates privacy, compliance, and data-governance risk if users are not clearly informed or if sensitive targets are submitted.

External Transmission

Medium
Category
Data Exfiltration
Content
Fetch results:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN&format=json"
```

### Step 3: Handle Edge Cases
Confidence
94% confidence
Finding
Fetching dataset items from Apify retrieves potentially large volumes of comment text and metadata from a third-party-hosted dataset, confirming that collected data is stored and served externally. This matters because exported content may contain personal data or sensitive research targets, and the skill does not adequately foreground that lifecycle.

External Transmission

Medium
Category
Data Exfiltration
Content
Fetch results:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN&format=json"
```

### Step 3: Handle Edge Cases
Confidence
94% confidence
Finding
Fetching dataset items from Apify retrieves potentially large volumes of comment text and metadata from a third-party-hosted dataset, confirming that collected data is stored and served externally. This matters because exported content may contain personal data or sensitive research targets, and the skill does not adequately foreground that lifecycle.

External Transmission

Medium
Category
Data Exfiltration
Content
Fetch results:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN&format=json"
```

### Step 3: Handle Edge Cases
Confidence
94% confidence
Finding
Fetching dataset items from Apify retrieves potentially large volumes of comment text and metadata from a third-party-hosted dataset, confirming that collected data is stored and served externally. This matters because exported content may contain personal data or sensitive research targets, and the skill does not adequately foreground that lifecycle.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.