scraping-youtube-comments

• Outcome: Review
• Latest audit: Sep 3, 2026 · 6:40 AM UTC
• Version: 1.0.0

Overview

The skill is a mostly disclosed Apify-based YouTube comment scraper, but its instructions mix narrow comment scraping with broader YouTube collection modes and expose an Apify token in URL-based API examples.

Review this skill before installing. It appears intended to use your Apify account to collect YouTube comment data, but the documented input scope may allow broader YouTube scraping than a single video's comments. Use a limited Apify token where possible, avoid sensitive research targets unless you are comfortable sending them to Apify, and be careful with examples that put APIFY_TOKEN in URLs because those URLs can appear in logs or shell history.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The documentation states the skill exports comments from any YouTube video, but the surrounding inputs and examples support non-video sources such as channels, playlists, search results, Shorts, and trending feeds. This inconsistency can mislead users and orchestration systems about what data will be collected, causing overbroad scraping and unexpected third-party transmission.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill relies on Apify and requires an APIFY_TOKEN, but the description does not clearly warn users that requested YouTube URLs, query data, and credentials are used with a third-party service. That omission undermines informed consent and can expose sensitive research targets, account usage, or billing context to an external provider unexpectedly.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documented inputs materially expand the skill from comment scraping on a video to broad YouTube scraping across channels, playlists, search, trending, and arbitrary transformation via custom JavaScript. This mismatch can cause agents or users to invoke data collection behaviors they did not intend, increasing privacy, compliance, and misuse risk because the effective capability is broader than the declared purpose.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The workflow examples invoke a different actor and advertise generic file export and output handling behavior that is not reflected in the narrow skill description. This creates a confused-deputy risk where an agent may run a broader or different external action than the user expects, potentially transmitting more data or producing transformed outputs outside the intended trust boundary.

External Transmission

Medium

• Category: Data Exfiltration

Content

**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~youtube-comments-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"videoUrls": ["<url>"], "maxComments": 200}'

• Confidence: 91% confidence
• Finding: This command posts user-supplied video URLs to Apify and includes the APIFY_TOKEN in the request URL, which is a real external data transmission. While expected for the skill's function, it is security-relevant because secrets in URLs may leak through shell history, logs, proxies, or monitoring systems, and user data is sent to a third party.

External Transmission

Medium

• Category: Data Exfiltration

Content

Save `id` as `RUN_ID`. Poll until `status = SUCCEEDED`:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID?token=$APIFY_TOKEN" | grep '"status"'
```

Fetch results:

• Confidence: 88% confidence
• Finding: Polling the actor-run endpoint transmits the APIFY_TOKEN in the URL again, creating repeated opportunities for token exposure in logs and tooling while interacting with a third-party service. Although operationally normal, it is a genuine security concern because credential-bearing URLs are broadly observable in many environments.

External Transmission

Medium

• Category: Data Exfiltration

Content

Save `id` as `RUN_ID`. Poll until `status = SUCCEEDED`:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID?token=$APIFY_TOKEN" | grep '"status"'
```

Fetch results:

• Confidence: 88% confidence
• Finding: Polling the actor-run endpoint transmits the APIFY_TOKEN in the URL again, creating repeated opportunities for token exposure in logs and tooling while interacting with a third-party service. Although operationally normal, it is a genuine security concern because credential-bearing URLs are broadly observable in many environments.

External Transmission

Medium

• Category: Data Exfiltration

Content

Save `id` as `RUN_ID`. Poll until `status = SUCCEEDED`:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID?token=$APIFY_TOKEN" | grep '"status"'
```

Fetch results:

• Confidence: 88% confidence
• Finding: Polling the actor-run endpoint transmits the APIFY_TOKEN in the URL again, creating repeated opportunities for token exposure in logs and tooling while interacting with a third-party service. Although operationally normal, it is a genuine security concern because credential-bearing URLs are broadly observable in many environments.

Static analysis

No suspicious patterns detected.