ClawHub
Back to skill

Security audit

tracking-competitor-social-media-growth

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent Apify-based social benchmarking purpose, but it exposes broader scraping and JavaScript transformation options and uses unsafe API-token examples without enough scoping or privacy guidance.

Review this before installing if the competitor list, monitored accounts, or Apify usage would reveal sensitive business plans. Use a least-privilege Apify token, prefer Authorization headers instead of token query parameters, avoid enabling follower-list or retweeter extraction unless specifically needed, and verify any helper script or scheduled task separately.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:96
Finding

Apify API Token Exposed in URL Query Parameters

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 96–101, 116–121, and 136–141
Vulnerability Type: Credential exposure through URL query parameters
Risk Level: Medium

Vulnerable Code

bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["[handle1]", "[handle2]"]}'
bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tiktok-profile-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["[handle1]", "[handle2]"]}'
bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["[handle1]", "[handle2]"], "maxItems": 12}'

Technical Analysis

All three documented REST fallback commands transmit APIFY_TOKEN as a URL query parameter. URLs are commonly recorded by HTTP servers, reverse proxies, observability platforms, command-line process monitoring, debugging tools, and error-reporting systems. Although HTTPS protects the URL while it is in transit, it does not prevent either endpoint or local process metadata from recording it.

When the shell expands $APIFY_TOKEN, the resulting token may also be visible in the curl process arguments to other sufficiently privileged local users or monitoring agents while the request is running. Placing a reusable credential in a URL therefore increases its exposure beyond the intended authentication boundary.

Attack Path

  1. A user sets a valid APIFY_TOKEN and follows one of the documented REST fallback commands.
  2. The shell substitutes the environment variable with the actual token in the URL passed to curl.
  3. The expanded URL is exposed through process telemetry or retained in server, proxy, monitoring, debugging, or diagnostic logs.
  4. An ...[truncated 802 chars]
Remediation
View remediation

Remediation Suggestions

Remove credentials from all URL query strings and send the token through Apify's supported authorization header instead:

bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["[handle1]", "[handle2]"]}'

Apply the same pattern to the TikTok and Instagram examples.

Additional hardening measures:

  1. Use a least-privilege Apify token with access restricted to the operations required by this skill.
  2. Keep the token in an environment variable or dedicated secret manager; do not store it in source files, command output, generated reports, or URLs.
  3. Configure logging and observability systems to redact Authorization headers and known credential fields.
  4. Avoid verbose HTTP debugging when authenticated requests are executed.
  5. Rotate any token previously used with these query-string examples if URLs may have been logged or captured.
  6. Document token revocation and incident-response procedures for suspected exposure.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Allowing a user-supplied customMapFunction introduces arbitrary JavaScript transformation capability into a skill that should only retrieve and compare social metrics. Even if the execution happens inside the third-party actor, this materially expands the attack surface and may permit code execution, data exfiltration, or unsafe processing beyond the intended analytics workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest says the skill triggers on requests like 'analyze a competitor's social media strategy' and 'see which competitor is winning on social,' which are broader than the specific function of tracking follower growth across platforms. These phrases could overlap with many ordinary marketing-analysis requests and may cause unintended invocation because no exclusion conditions or tighter scope boundaries are provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill directs users to send account handles and related query data to Apify-operated scrapers without clearly warning that this information is transmitted to a third party. In competitive-intelligence contexts, even public account targeting can reveal sensitive business interests, monitored competitor sets, or internal benchmarking activity.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented Twitter inputs expose capabilities far beyond the stated purpose of competitor follower-growth benchmarking, including follower/following list extraction and retweeter collection. This creates scope creep that can enable broader surveillance or collection of third-party social graph data not necessary for the skill’s advertised function.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The documented curl command explicitly transmits usernames and an API token to an external Apify endpoint. External transmission is expected for this skill’s function, but it remains security-relevant because it shares monitoring targets and uses credentials in a third-party service context without nearby warning or minimization guidance.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

REST API fallback:

bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["[handle1]", "[handle2]"]}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

REST API fallback:

bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["[handle1]", "[handle2]"]}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
81% confidence
Finding

This workflow sends TikTok usernames to a third-party Apify actor, which is an external data transfer relevant to privacy and operational security. In the context of competitor tracking, the transmitted target list may expose sensitive research or market-monitoring priorities even if the accounts themselves are public.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

REST API fallback:

bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tiktok-profile-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["[handle1]", "[handle2]"]}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
81% confidence
Finding

The Instagram fallback similarly transmits competitor handles to Apify, creating third-party disclosure of monitoring targets and associated request metadata. The skill context makes this more sensitive because competitive analysis datasets can reveal internal strategy, client interests, or market focus.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

REST API fallback:

bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["[handle1]", "[handle2]"], "maxItems": 12}'

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

Requesting an APIFY_TOKEN without warning that it will authorize external API calls can mislead users about how their credential is used and where requests are sent. While the token itself is not directly exposed in the document, lack of disclosure increases the risk of unintended third-party access and operational misuse.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.