scraping-tiktok-profile-data

• Outcome: Pass
• Latest audit: Sep 3, 2026 · 6:37 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Apify-backed TikTok profile scraper, with expected external API use and no hidden persistence or destructive behavior.

Install only if you are comfortable sending TikTok usernames, profile URLs, and related query parameters to Apify under your Apify account. Keep APIFY_TOKEN in environment or a managed secret store, avoid placing sensitive creator lists in shared command history/logs, and review Apify dataset retention/deletion settings after runs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The documented inputs expand the skill beyond simple profile lookups by introducing post-level date filters and a `customMapFunction` that allows arbitrary JavaScript transformation of returned data. This creates a scope mismatch with the manifest and can enable unsafe or unexpected processing behavior, especially if downstream tooling executes or trusts the supplied transformation function.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs users to send TikTok usernames and query parameters to Apify but does not clearly disclose that this data is transmitted to a third-party service. This is a privacy and transparency issue because users may assume the skill operates locally or within the agent environment when it actually sends request data externally.

External Transmission

Medium

• Category: Data Exfiltration

Content

**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tiktok-profile-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["creator1", "creator2"]}'

• Confidence: 94% confidence
• Finding: This command posts user-supplied TikTok usernames to Apify's external API, which is an intentional data exfiltration channel to a third party. While expected for the skill's function, it becomes dangerous without explicit consent and data-handling disclosure, especially for bulk creator lists that may be sensitive business intelligence.

External Transmission

Medium

• Category: Data Exfiltration

Content

Fetch results:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN&format=json"
```

### Step 3: Handle Edge Cases

• Confidence: 90% confidence
• Finding: Fetching dataset results from Apify continues the third-party data flow and may return scraped profile data through an external service without clearly informing the user. If the resulting dataset contains sensitive enrichment data or proprietary account lists, this can expose business context to the third-party processor.

External Transmission

Medium

• Category: Data Exfiltration

Content

Fetch results:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN&format=json"
```

### Step 3: Handle Edge Cases

• Confidence: 90% confidence
• Finding: Fetching dataset results from Apify continues the third-party data flow and may return scraped profile data through an external service without clearly informing the user. If the resulting dataset contains sensitive enrichment data or proprietary account lists, this can expose business context to the third-party processor.

External Transmission

Medium

• Category: Data Exfiltration

Content

Fetch results:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN&format=json"
```

### Step 3: Handle Edge Cases

• Confidence: 90% confidence
• Finding: Fetching dataset results from Apify continues the third-party data flow and may return scraped profile data through an external service without clearly informing the user. If the resulting dataset contains sensitive enrichment data or proprietary account lists, this can expose business context to the third-party processor.

VirusTotal

61/61 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.