Apify HN Scraper

PassAudited by ClawScan on May 1, 2026.

Overview

This is a straightforward Apify-based Hacker News scraper, but users should understand it uses their Apify token and an external Apify Actor.

This skill appears safe and purpose-aligned for scraping Hacker News through Apify. Before installing, make sure you trust the referenced Apify Actor, understand that your APIFY_TOKEN will be used to run it, and review scrape size settings such as maxResults to avoid unexpected Apify usage.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Using the skill can run an Apify Actor under the user's Apify account and may consume Apify credits or quota.

Why it was flagged

The skill uses shell commands to call the Apify REST API. This is central to its stated purpose and is not hidden, but users should notice that the agent may run API calls that consume Apify resources.

Skill content

RESULT=$(curl -s -X POST "https://api.apify.com/v2/acts/0UDODOnpTkxY3Oc90/run-sync-get-dataset-items?token=$APIFY_TOKEN" ...)

Recommendation

Confirm search terms and maxResults before running, and use an Apify token with only the access needed for this task.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill can authenticate to Apify as the user and run the specified actor using that account.

Why it was flagged

The skill requires an Apify API token. This is expected for an Apify-based scraper, but it gives the workflow delegated authority to use the user's Apify account.

Skill content

Requires APIFY_TOKEN environment variable.

Recommendation

Provide a dedicated or least-privilege Apify token if available, and avoid sharing the token in chat or logs.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Results and billing depend on the external Apify Actor continuing to behave as expected.

Why it was flagged

The skill depends on a fixed external Apify Actor whose implementation is not included in the artifact. This is disclosed and purpose-aligned, but users are relying on that actor's behavior.

Skill content

Scrape Hacker News using an Apify Actor via the REST API. Actor ID `0UDODOnpTkxY3Oc90`

Recommendation

Verify the Apify Actor ID and publisher in Apify before using it for important or high-volume scraping.