ClawHub
Back to skill

Security audit

Apify Runner

Security checks for vulnerabilities and agentic risk

Overview

This Apify scraping skill is mostly purpose-aligned, but it handles Apify credentials unsafely and can send user targets to third-party actors with limited disclosure and confirmation.

Review this before installing if you will use real Apify account tokens or sensitive target lists. Prefer a limited-scope Apify token, avoid the documented --token command-line form, keep config files out of version control with restrictive permissions, and confirm which actor will receive your targets before running full jobs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/apify_runner.py:44
Finding

Apify API Token Exposure Through URL Query Parameters and Command-Line Arguments

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

The code does support core Apify Actor execution behavior: starting actor runs, probe testing, batch splitting, polling/waiting, and collecting dataset results. However, it does not implement Actor discovery or any quality filtering/ranking of candidate Actors. Instead, it requires the caller to provide an explicit actor_id and simply executes that actor. So the description overstates important capabilities, making it a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description promises an end-to-end capability to run Apify Actors for scraping, including discovery, quality filtering, probe testing, batched execution, and result collection. The supplied code chunk implements only the discovery/filtering portion: it queries the Apify Store API, applies quality thresholds, scores actors, and returns ranked candidates. There is no code to invoke actors, pass inputs, monitor runs, test outputs, batch executions, or retrieve scraping results. So the actual behavior is a narrower subset and materially different from the declared primary purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill instructs use of environment variables, local config files, network fetches, and writing results to disk, but it declares no explicit tool scope or permission boundaries. In an agent setting, that omission makes the skill harder to sandbox and review, increasing the risk of unintended access to secrets, local files, and outbound data transmission.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger is broad enough to activate for many generic requests to extract website or social-media data, which can cause the agent to invoke third-party scraping workflows without a clear user expectation of external transmission. In context, this is more dangerous because the skill can target many platforms and automate actor selection and execution, expanding chances of over-collection or unintended use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill does not warn users that their targets, URLs, usernames, keywords, and filters may be transmitted to a third-party service during actor discovery, documentation fetches, probe runs, and full execution. In a scraping skill, that missing disclosure materially affects privacy and data-handling expectations, especially when users may provide sensitive investigative or proprietary target lists.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
- The user's targets and filters
- Sensible defaults from the documentation

**Do NOT ask the user to write JSON.** Build it from their natural language request.

### Step 5: Probe Test (Top 1 → Top 2 → Top 3 fallback)

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/apify_runner.py (reported line 41)May include surrounding context.

python
def start_run(actor_id, run_input, token):
    """启动 Actor Run"""
    url = f"{API_BASE}/acts/{actor_id.replace('/', '~')}/runs"
    resp = requests.post(
        url,
        json=run_input,
        headers={"Content-Type": "application/json"},

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/apify_runner.py (reported line 22)May include surrounding context.

python
import argparse
import requests

STORE_API = "https://api.apify.com/v2/store"

# 质量筛选阈值
MIN_SUCCESS_RATE = 0.95

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search_actor.py (reported line 13)May include surrounding context.

python
import argparse
import requests

STORE_API = "https://api.apify.com/v2/store"

# 质量筛选阈值
MIN_SUCCESS_RATE = 0.95

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The workflow supports saving raw JSON results to an output path but does not warn that collected data may be written to local disk. That omission can lead to unintentional persistence of scraped content, including potentially sensitive data, in shared or insecure locations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The module docstring and CLI help text are written in Chinese, which constitutes a language-specific instruction surface for users. Under the policy rule, locale or language constraints should either be optional for the user or clearly justified as region-specific; this file provides neither.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.