tracking-competitor-social-media-growth

• Outcome: Pass
• Latest audit: Sep 3, 2026 · 6:39 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Apify-based workflow for collecting public social-media metrics, with credential and privacy hygiene cautions but no hidden or malicious behavior found.

Install only if you are comfortable sending the listed public account handles and collected metrics to Apify. Store APIFY_TOKEN as a protected environment secret, avoid pasting token-bearing URLs into shared logs or screenshots, and review any scheduled weekly automation before enabling it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest description repeatedly promises growth tracking, growth indicators, and monitoring follower counts over time. However, the file only documents one-off scraping of current profile metrics from Twitter, TikTok, and Instagram, and later states that users must rerun the skill weekly and store outputs themselves to derive deltas. That is a meaningful mismatch between the promised capability and the implemented behavior.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill instructs users to send competitor/account identifiers to Apify and recommends storing outputs over time, but it does not disclose that this data is transmitted to and retained by a third party. In enterprise settings, even public social-account monitoring data may be sensitive competitive-intelligence material, so silent external sharing and retention can create privacy, compliance, and governance risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["[handle1]", "[handle2]"]}'

• Confidence: 88% confidence
• Finding: The documented curl command sends account identifiers to an external Apify endpoint and includes the API token in the URL query string. External transmission is expected for this skill's purpose, but placing the token in the URL can cause credential leakage via shell history, logs, proxies, browser tooling, or monitoring systems that record full request URLs.

External Transmission

Medium

• Category: Data Exfiltration

Content

**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tiktok-profile-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["[handle1]", "[handle2]"]}'
```

• Confidence: 87% confidence
• Finding: This command sends TikTok profile identifiers to a third-party service and again places APIFY_TOKEN in the URL query string. The skill context makes external API use legitimate, but the combination of undocumented data transfer and insecure token placement creates avoidable exposure risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tiktok-profile-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["[handle1]", "[handle2]"]}'
```

• Confidence: 87% confidence
• Finding: This command sends TikTok profile identifiers to a third-party service and again places APIFY_TOKEN in the URL query string. The skill context makes external API use legitimate, but the combination of undocumented data transfer and insecure token placement creates avoidable exposure risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tiktok-profile-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["[handle1]", "[handle2]"]}'
```

• Confidence: 87% confidence
• Finding: This command sends TikTok profile identifiers to a third-party service and again places APIFY_TOKEN in the URL query string. The skill context makes external API use legitimate, but the combination of undocumented data transfer and insecure token placement creates avoidable exposure risk.

Description-Behavior Mismatch

Low

• Confidence: 87% confidence
• Finding: The manifest says the skill returns engagement benchmarks per competitor and can analyze a competitor's social media strategy. In the file, the actual behavior is limited to scraping profile-level counts and assembling a report template; there is no concrete methodology for engagement benchmarking or strategy analysis beyond simple metric comparison. This overstates the analytical depth of the skill.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: Requiring an APIFY_TOKEN without any credential-handling guidance increases the chance that users expose the token in shell history, logs, screenshots, shared scripts, or committed files. While the document does not directly leak the secret, weak operational guidance around API credentials is a real security hygiene issue.

VirusTotal

60/60 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.