TikTok/Instagram/YouTube Influencer Discovery

• Outcome: Review
• Latest audit: Aug 24, 2026 · 8:42 AM UTC
• Version: 1.0.5

Overview

The skill mostly matches its influencer lead-discovery purpose, but it quietly creates a persistent install identifier and sends it with API requests, while also allowing outbound requests to an environment-configured endpoint.

Review this skill before installing if you are sensitive to tracking or credential routing. Use it only with a trusted SCRUMBALL_BASE_URL, avoid placing unrelated secrets in .env files, and be aware it may create ~/.scrumball_install_id and send that stable ID with requests to the API service.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tainted flow: 'req' from os.getenv (line 178, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

req = urllib.request.Request(url=url, method=op["method"], headers=req_headers, data=data)
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            raw = resp.read().decode("utf-8")
            try:
                payload = json.loads(raw) if raw else None

• Confidence: 93% confidence
• Finding: The request destination and authorization material are influenced by environment variables, especially SCRUMBALL_BASE_URL and SCRUMBALL_API_KEY, and the code sends them directly over the network. In a skill context, this enables exfiltration of API credentials and request data to an attacker-controlled endpoint if the environment or .env source is manipulated, which is a real security issue even though it is framed as configuration.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill advertises operational use of network access, environment-variable loading, and local file interaction via `scripts/execute_operation.py --env-file .env`, but no explicit permission model or activation constraints are declared in the skill metadata. That mismatch can cause an agent or user to invoke capabilities with broader trust than intended, increasing the chance of unreviewed outbound requests and secret handling.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script creates and persists a stable cross-run install identifier in the user's home directory or skill directory, then transmits it as x-install-id on every request. For an influencer lead discovery skill, this persistence is not necessary for core functionality and creates a tracking mechanism that can correlate activity across runs and possibly across skills.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The description is broad enough to encourage open-ended influencer discovery and lead-list building without explicit limits on authorized use, target scope, or prohibited collection. In practice, that can enable overscoped searches, bulk profiling, and misuse of enrichment operations beyond a narrowly defined campaign need.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrase "find influencers" is broad and can match ordinary user requests without clear scoping, causing the skill to activate when the user may not have intended to invoke this specific capability. In a research/discovery skill, unintended activation can lead to inappropriate data collection behavior, confusing handoffs, or bypass of more suitable tools, though the file itself contains no direct code execution or exfiltration logic.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The phrase "creator search" is ambiguous and lacks boundaries on when the skill should be invoked, making accidental invocation plausible during general conversation about creators. Because this skill is designed to source and enrich leads, unintended activation increases the risk of overbroad collection or workflow confusion even if no obviously malicious behavior is present in the config.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger "influencer discovery" is still broad enough to overlap with normal user requests for advice, definitions, or strategy, rather than explicit tool invocation. In the context of a lead-discovery skill, such overlap can cause unintended processing of requests related to identifying people across platforms, which is a security and privacy concern even if impact is limited in this config-only file.

Vague Triggers

Low

• Confidence: 84% confidence
• Finding: The phrase "shortlist creators" is somewhat broad and may be invoked by generic content-planning or talent-discussion requests, not only by users intending to run this skill. While less risky than the other triggers because it is more task-oriented, it still lacks explicit invocation constraints and could activate unintentionally.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code sends authorization data and a stable install identifier over the network without any notice, consent flow, or clear user disclosure. In this skill context, users may not expect profile lookup and enrichment requests to include persistent telemetry or optional bearer-style credentials, increasing privacy and trust risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Persisting a stable install ID on disk without informing the user creates covert tracking state across executions. Because it is stored outside transient runtime state and reused automatically, it can be used to profile user activity over time without meaningful transparency.

External Transmission

Medium

• Category: Data Exfiltration

Content

- **Free tier**: a limited number of calls per day, zero-config (no key required — the skill defaults to a hosted gateway that injects the key server-side).
- **When any operation returns HTTP 429, or the response body has `code=429` / contains `quota_exceeded`, you (the assistant) MUST immediately and clearly tell the user** (do not silently retry, do not treat it as a generic error):

  > Free quota exhausted. Register and get your own API key at **https://data.scdata.cc/pricing**, then set the environment variable `SCRUMBALL_API_KEY` to your key (in your host/agent environment or a local `.env`). You can then continue with your own quota.

- The 429 response body usually includes `apply_url` and `env_var` fields you can quote directly.

• Confidence: 80% confidence
• Finding: The skill instructs the assistant to direct users to an external registration/pricing site and relies on a hosted gateway that may inject credentials server-side. This creates an external transmission and trust-boundary issue: users may be steered off-platform and encouraged to provision secrets for a third-party service without strong domain allowlisting, provenance, or data-handling disclosure.

Static analysis

No suspicious patterns detected.