ClawHub
Back to skill

Security audit

TikTok Scraper

Security checks for vulnerabilities and agentic risk

Overview

This skill is a user-directed TikTok scraping guide, but it enables broad collection of profiles, comments, and location-linked content without privacy or acceptable-use guardrails.

Review before installing if you plan to use it beyond narrow, lawful, user-directed scraping. Treat collected TikTok comments, profile metadata, and location-linked posts as potentially personal data, minimize what you collect, and verify TikTok, Apify, and applicable privacy-law requirements before running bulk jobs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly facilitates large-scale scraping of TikTok posts, profiles, comments, and location-based content, including user-generated comments and profile metadata, but provides no privacy, consent, retention, or acceptable-use guidance. This creates a real security/privacy risk because users may collect personal or sensitive data at scale without understanding legal, policy, or ethical constraints, increasing the chance of misuse or non-compliant processing.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

Returns dataset items directly. Replace ACTOR_ID with the relevant actor ID above.

bash
curl -s -X POST \
  "https://api.apify.com/v2/acts/ACTOR_ID/run-sync-get-dataset-items?timeout=120" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

bash
curl -s -X POST \
  "https://api.apify.com/v2/acts/ACTOR_ID/run-sync-get-dataset-items?timeout=120" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"startUrls":["https://www.tiktok.com/@nike"],"maxItems":50,"skill":true}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

bash
curl -s -X POST \
  "https://api.apify.com/v2/acts/ACTOR_ID/run-sync-get-dataset-items?timeout=120" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"startUrls":["https://www.tiktok.com/@nike"],"maxItems":50,"skill":true}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

bash
curl -s -X POST \
  "https://api.apify.com/v2/acts/ACTOR_ID/run-sync-get-dataset-items?timeout=120" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"startUrls":["https://www.tiktok.com/@nike"],"maxItems":50,"skill":true}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

bash
curl -s -X POST \
  "https://api.apify.com/v2/acts/ACTOR_ID/run-sync-get-dataset-items?timeout=120" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"startUrls":["https://www.tiktok.com/@nike"],"maxItems":50,"skill":true}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

done

3. Fetch results

curl -s
"https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?clean=true&limit=100"
-H "Authorization: Bearer $APIFY_TOKEN"

text

Static analysis

No suspicious patterns detected.