ClawHub
Back to skill

Security audit

scraping-tiktok-posts-by-music

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward TikTok-by-sound scraping guide that uses Apify, with no hidden install steps or persistence.

Install only if you intend to use Apify for TikTok scraping. Use a scoped Apify token, avoid putting sensitive or private URLs in inputs, and set maxItems when you do not want large collection runs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger description is broad enough to match many user requests about TikTok sounds, music, creators, and exports without clearly constraining when the skill should activate. Over-broad activation can cause the agent to invoke this skill unexpectedly, leading to unintended scraping and transmission of user-supplied URLs or queries to Apify.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs use of an external Apify service but does not warn that user-provided TikTok URLs and the APIFY_TOKEN will be transmitted to a third party. This creates a consent and data-handling risk because users may not realize their inputs leave the local agent environment.

External Transmission

Medium
Category
Data Exfiltration
Content
### REST API fallback

```bash
curl -X POST "https://api.apify.com/v2/acts/apidojo~tiktok-music-scraper/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"startUrls": ["https://www.tiktok.com/music/Song-Title-123456"], "maxItems": 100}'
Confidence
92% confidence
Finding
This skill explicitly posts data to Apify's external API using a bearer token, which constitutes external transmission of user inputs and credentials. While expected for a scraping integration, it is still security-relevant because invoking the skill shares data with a third party and may expose sensitive URLs, usage patterns, or secrets if mishandled.

External Transmission

Medium
Category
Data Exfiltration
Content
### REST API fallback

```bash
curl -X POST "https://api.apify.com/v2/acts/apidojo~tiktok-music-scraper/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"startUrls": ["https://www.tiktok.com/music/Song-Title-123456"], "maxItems": 100}'
Confidence
92% confidence
Finding
This skill explicitly posts data to Apify's external API using a bearer token, which constitutes external transmission of user inputs and credentials. While expected for a scraping integration, it is still security-relevant because invoking the skill shares data with a third party and may expose sensitive URLs, usage patterns, or secrets if mishandled.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.