Social Media Data Hub

• Outcome: Review
• Latest audit: May 29, 2026 at 9:26 PM UTC
• Version:
  1.0.0

Overview

This skill appears purpose-built for Apify-based social-media data collection, but it handles the Apify token in URL query strings and should be reviewed before use.

Review before installing. Use a dedicated or limited Apify token, monitor spending, avoid confidential or regulated investigations unless your organization approves Apify processing, and ask the publisher to move authentication out of URL query strings and add a clearer privacy/data-flow warning.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs users to provide usernames, profile URLs, post URLs, and raw JSON for processing, but does not clearly warn that these inputs and resulting retrieved content are sent to Apify's external API. This creates a real privacy and data-governance risk because operators may unknowingly transmit potentially sensitive investigative targets, account identifiers, or collected content to a third party.

VirusTotal

65/65 vendors flagged this skill as clean.