Apify Bluesky Scraper

PassAudited by ClawScan on May 1, 2026.

Overview

This skill coherently uses an Apify token to run a Bluesky scraping actor and does not show hidden, destructive, or deceptive behavior.

This appears safe to install if you intend to use Apify to search Bluesky. Before running it, verify the Apify Actor and use a limited Apify token if possible, because searches are sent to Apify and may consume your account quota.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Using the skill can make external API calls under the user's Apify account and may incur quota or billing usage.

Why it was flagged

The skill directs the agent to call an external Apify REST API actor using curl. This is central to the skill's purpose, but it means user-provided search terms are sent to Apify and may consume account quota.

Skill content

RESULT=$(curl -s -X POST "https://api.apify.com/v2/acts/WAJfBnZBYR9mJrk5d/run-sync-get-dataset-items?token=$APIFY_TOKEN"

Recommendation

Confirm search terms and result limits before running, and monitor Apify usage for large or repeated jobs.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill operates with whatever Apify permissions and quota are available to the provided APIFY_TOKEN.

Why it was flagged

The skill requires an Apify credential to run the external actor. This credential use is disclosed and purpose-aligned, with no artifact evidence of unrelated access or leakage.

Skill content

Requires APIFY_TOKEN environment variable.

Recommendation

Use a limited-scope Apify token where possible and avoid sharing command output or logs that may contain token-bearing URLs.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Results and data handling depend on the external Apify Actor identified by the skill.

Why it was flagged

The skill relies on a specific external Apify Actor rather than bundled reviewed code. This is expected for an Apify integration, but the actor's implementation and provenance are not shown in the provided artifacts.

Skill content

Actor ID
`WAJfBnZBYR9mJrk5d`

Recommendation

Review the Apify Actor page, owner, permissions, and pricing before using it for sensitive searches or high-volume scraping.