scraping-tiktok-videos-by-hashtag

• Outcome: Pass
• Latest audit: Sep 3, 2026 · 6:38 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward TikTok scraping helper that uses Apify/apidojo as disclosed, with no hidden persistence or unrelated access.

Install only if you are comfortable sending TikTok URLs, hashtags, keywords, and collected results to Apify/apidojo. Avoid using sensitive, private, regulated, or confidential investigation targets, and treat APIFY_TOKEN as a secret even though the REST fallback shows it in URLs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill description does not warn users that hashtags, keywords, URLs, and resulting data are processed by a third-party service (Apify/apidojo). This creates a transparency and consent problem, especially if users provide sensitive research terms, private targets, or regulated data in prompts.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger phrases are broad enough that the skill may activate for generic requests about TikTok topics, trends, or exports without clearly signaling that data will be sent to a third-party scraping service. This increases the chance of unintended invocation and external transmission of user-provided search terms or URLs.

External Transmission

Medium

• Category: Data Exfiltration

Content

**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"keywords": ["tag1", "tag2"], "maxItems": 100}'

• Confidence: 88% confidence
• Finding: This step explicitly transmits user-supplied keywords and parameters to an external API, which is expected for the skill's function but still represents a real data egress path. If the user query contains sensitive terms or identifiers, those are disclosed to a third party and could be logged outside the local environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

Fetch results:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN&format=json"
```

### Step 3: Handle Edge Cases

• Confidence: 90% confidence
• Finding: Fetching dataset items retrieves potentially sensitive scraped content from the external service, meaning both the original request and resulting data are handled off-platform. This is a real egress and retrieval path that can expose user interests, targets, or collected records to third-party retention and logging.

External Transmission

Medium

• Category: Data Exfiltration

Content

Fetch results:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN&format=json"
```

### Step 3: Handle Edge Cases

• Confidence: 90% confidence
• Finding: Fetching dataset items retrieves potentially sensitive scraped content from the external service, meaning both the original request and resulting data are handled off-platform. This is a real egress and retrieval path that can expose user interests, targets, or collected records to third-party retention and logging.

External Transmission

Medium

• Category: Data Exfiltration

Content

Fetch results:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN&format=json"
```

### Step 3: Handle Edge Cases

• Confidence: 90% confidence
• Finding: Fetching dataset items retrieves potentially sensitive scraped content from the external service, meaning both the original request and resulting data are handled off-platform. This is a real egress and retrieval path that can expose user interests, targets, or collected records to third-party retention and logging.

Static analysis

No suspicious patterns detected.