T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:88- Finding
Apify API Token Exposed Through URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
scraping-youtube-channel-data
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its YouTube scraping purpose, but it gives unsafe Apify token examples and has scope and actor-name inconsistencies that users should review before use.
Install only if you are comfortable sending the requested YouTube identifiers and scrape results to Apify. Use a dedicated, least-privilege Apify token, avoid the documented token-in-URL curl examples, and verify the intended Apify actor before running it.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The workflow says the skill delivers channel datasets, but the examples invoke a different actor name and imply broader scraper behavior. This inconsistency increases the risk that an agent runs an unintended external actor with different data collection semantics, outputs, or permissions than the user expects.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill is presented as a YouTube channel statistics tool, but its documented inputs expand scope to playlists, Shorts, search keywords, and trending retrieval. This mismatch can cause an agent or user to invoke broader scraping behavior than expected, weakening informed consent and policy gating around what data is collected and sent to the external service.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This command transmits user-supplied channel data and an authentication token to an external Apify endpoint. External transmission is expected for this skill, but it remains security-relevant because it creates third-party data exposure and token-handling risk if users are not clearly informed or if requests are constructed from unreviewed input.
- Content
REST API fallback:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~youtube-channel-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"channelUrls": ["https://www.youtube.com/@channelhandle"], "maxVideos": 30}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
REST API fallback:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~youtube-channel-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"channelUrls": ["https://www.youtube.com/@channelhandle"], "maxVideos": 30}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
REST API fallback:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~youtube-channel-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"channelUrls": ["https://www.youtube.com/@channelhandle"], "maxVideos": 30}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
REST API fallback:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~youtube-channel-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"channelUrls": ["https://www.youtube.com/@channelhandle"], "maxVideos": 30}'
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The skill instructs use of APIFY_TOKEN without a clear warning that the token authenticates calls to a third-party service and may expose account activity or billing if mishandled. While not an exploit by itself, missing credential-handling guidance can lead to accidental leakage or unsafe operational use.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The REST examples send channel query data to Apify without an explicit privacy or integrity notice. Users may not realize that requested URLs, handles, and result metadata are being transmitted to and processed by an external provider, which matters in enterprise or sensitive research contexts.
- Content
Static analysis
No suspicious patterns detected.