ClawHub
Back to skill

Security audit

Instagram Transcript Extractor

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently processes user-supplied public Instagram links through Apify, with safeguards for credentials, duplicate submissions, and incomplete results.

Submitted links are processed by the named third-party Apify Actor using your connected account and may incur charges. Review its pricing and data handling, and configure credentials only through the host's private connection settings. Results may remain provisional when the plugin cannot prove complete retrieval. The external Actor's code is outside this inspected bundle.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/workflow.md (reported line 31)May include surrounding context.

md
## Recovery

Call `{"operation":"next_action","state":{"phase":"running","run_id":"..."}}` whenever choosing a next run/read action. It returns a policy decision, not a tool invocation; use the live host tool schema and keep identifiers in authorized storage. Phases: `new`, `submission_unknown`, `running`, `terminal`, `read_incomplete`, `unknown_unresolved`, `complete`. A lost submission requires history lookup, not another start; running queries the same run; incomplete reads retry reading. `start` is only valid before a submission has been attempted; do not reset state to `new` on timeout. The helper cannot persist state or confirm a run exists. If unable to identify a unique prior run, report unknown. For terminal failures inspect accessible partial data, and only retry a confirmed target under the user's intent after checking prior results; do not retry successes or unknown submissions.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: network.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium
Category
Output Handling
Confidence
60% confidence
Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · references/workflow.md (reported line 25)May include surrounding context.

md
ust be `SUCCEEDED`, `FAILED`, `ABORTED`, or `TIMED-OUT`, with all pages complete. Only a complete successful batch can mark unmatched requests `not_returned`; complete failed, aborted or timed-out batches mark them `run_failed`. Overall `complete` is true only if every planned batch has complete, correctly bound evidence; it does not mean all runs succeeded.

Without a reliable total, finish only if the actual tool contract exposes a trustworthy explicit end-of-data signal and the host confirms no truncation; record `end_of_data:true` and `end_evidence` naming its source and field. A short or empty page alone is not conclusive without a documented guarantee. For missing evidence provide an empty list; run still active, unknown submission, incomplete pagination or conflicting observations remain pending. A complete dataset may contain fewer items than requested, including zero. The helper validates the consistency of supplied batch plan and observations only: it cannot independently pro