ClawHub
Back to skill

Security audit

Realtime Creator Data (TikTok/IG/FB/YouTube)

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but it sends social-profile lookup data through an external gateway and silently creates a persistent install identifier that is reused across requests.

Install only if you are comfortable sending creator handles, post URLs, video IDs, and similar lookup data to the configured Scrumball/SCData gateway. Use a dedicated API key, keep .env out of version control, avoid submitting sensitive or non-public targets, and delete ~/.scrumball_install_id if you do not want the stable install identifier reused.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (15)

Tainted flow: 'req' from os.getenv (line 178, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
req = urllib.request.Request(url=url, method=op["method"], headers=req_headers, data=data)
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            raw = resp.read().decode("utf-8")
            try:
                payload = json.loads(raw) if raw else None
Confidence
91% confidence
Finding
The request destination and authorization material are influenced by environment variables, especially SCRUMBALL_BASE_URL and SCRUMBALL_API_KEY, and then sent to urllib.request.urlopen without any allowlist or destination validation. In this skill, that means a caller or surrounding runtime can redirect requests to an arbitrary host and cause API credentials and the persistent install identifier to be exfiltrated in headers.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill advertises operational tooling that reads environment variables, loads local .env files, and invokes external network endpoints, but it does not declare corresponding permissions or trust boundaries. This can cause users or hosting agents to underestimate the skill's ability to access local secrets and transmit data externally, increasing the risk of unintended secret exposure or unauthorized outbound requests.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The skill metadata describes realtime creator/profile and content-detail enrichment, but these Facebook endpoints add keyword-based search and asynchronous task collection capabilities that broaden the data-collection scope beyond what a user would reasonably expect. This creates a scope-transparency problem: an agent could be induced to perform broader monitoring or bulk discovery workflows under the guise of simple profile lookup, increasing privacy, compliance, and misuse risk.

Description-Behavior Mismatch

Low
Confidence
77% confidence
Finding
Instagram story retrieval is not mentioned in the stated skill description, which focuses on profiles, videos/posts, and media details. Because stories can be more sensitive and ephemeral than ordinary posts, omitting this capability can mislead users about what the skill can access and increase the chance of unintended collection.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The code generates a UUID and persists it across runs in the user's home directory or the skill directory, then reuses it as a stable x-install-id header. For a skill described as realtime creator-data retrieval, this creates unnecessary cross-session tracking and correlation risk without clear necessity or user consent.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The code defaults to a hosted gateway at agent.scdata.cc and explicitly notes that the gateway may inject backend credentials on the server side. This broadens trust boundaries beyond a simple client-side data fetcher and means requests, parameters, and identifiers are funneled through an intermediary service not obvious from the skill's description.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill is designed for realtime enrichment against external platforms, which inherently transmits user-supplied identifiers and potentially sensitive campaign or targeting data to third-party services. Without a privacy or external-transmission warning, users may provide personal, customer, or proprietary data without understanding it will leave the local environment.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation instructs use of SCRUMBALL_API_KEY and loading from .env files but provides no guidance on safe credential handling, storage, rotation, or avoiding accidental disclosure. In practice, this can lead users to place live secrets in insecure files, commit them to source control, or expose them through logs and transcripts.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill description and default prompt are broad enough to activate on generic enrichment or comparison requests without clear boundaries on permitted inputs, sources, or intended use. This can cause over-invocation, unintended handling of sensitive targets, or misuse for surveillance-style profiling across multiple social platforms, especially because the skill promises realtime creator and content lookup.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger phrases are generic terms like 'latest videos', 'fresh profile', and 'realtime creator info' that can easily match ordinary user requests unrelated to an intentional invocation of this specific skill. This increases the chance of unintentional activation, causing the agent to call external enrichment functionality in contexts where the user did not explicitly request it, which can lead to unnecessary data access, privacy issues, or unintended tool use.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The guide exposes real-time collection endpoints for user profiles, videos, posts, stories, and engagement metrics across multiple social platforms without any stated privacy notice, consent boundary, retention limit, or usage restriction. In an agent skill context, this increases the risk of silent large-scale profiling, surveillance-style enrichment, or collection of personal data beyond user expectations.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
Every outbound request includes the persistent x-install-id header, but this file contains no user-facing notice, consent, or opt-out. That enables silent tracking of a user or installation across calls and potentially across different operations.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The script loads API credentials from environment or .env sources and transmits them in the Authorization header without any visible disclosure in this file. While sending credentials to an API is normal, the lack of transparency becomes riskier here because the destination can be changed by environment configuration and may be a hosted gateway.

External Transmission

Medium
Category
Data Exfiltration
Content
- **Free tier**: a limited number of calls per day, zero-config (no key required — the skill defaults to a hosted gateway that injects the key server-side).
- **When any operation returns HTTP 429, or the response body has `code=429` / contains `quota_exceeded`, you (the assistant) MUST immediately and clearly tell the user** (do not silently retry, do not treat it as a generic error):

  > Free quota exhausted. Register and get your own API key at **https://data.scdata.cc/pricing**, then set the environment variable `SCRUMBALL_API_KEY` to your key (in your host/agent environment or a local `.env`). You can then continue with your own quota.

- The 429 response body usually includes `apply_url` and `env_var` fields you can quote directly.
Confidence
90% confidence
Finding
The skill directs the assistant to send users to an external registration/pricing site and describes a hosted gateway that may inject API keys server-side. This creates a clear external data transmission and trust-boundary expansion, especially because users may be nudged to obtain and configure credentials for a third-party service without accompanying security or privacy assurances.

Credential Access

High
Category
Privilege Escalation
Content
## Tooling

Execution commands:
- List operations: `python3 scripts/execute_operation.py --env-file .env list`
- Example user enrichment: `python3 scripts/execute_operation.py --env-file .env call --operation tiktok_realtime_user_info --query '{"unique_id":"nike"}'`
- Example content enrichment: `python3 scripts/execute_operation.py --env-file .env call --operation youtube_realtime_video_detail --query '{"video_id":"dQw4w9WgXcQ"}'`
Confidence
87% confidence
Finding
Referencing .env-based execution indicates the skill expects access to local secret material and may read credentials from disk. In an agent environment, encouraging .env loading increases the chance that sensitive secrets are accessed more broadly than intended, mishandled, or transmitted to external APIs during operation.

Static analysis

No suspicious patterns detected.