Apify HN Scraper

• Analyzed: May 11, 2026, 5:38 AM
• Findings: 1
• Version: 1.0.0
• Hash: 201e860b67a062d669d2ba872949d330036e35622b558a33237f48e30d128c67
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill facilitates Hacker News scraping via the Apify API but contains vulnerabilities in the SKILL.md command templates. Specifically, it passes the sensitive APIFY_TOKEN within the URL query string and lacks input sanitization for the TERM placeholder in curl commands, which could lead to credential exposure in logs or shell injection if user input is not properly escaped by the AI agent. The Actor ID 0UDODOnpTkxY3Oc90 is a legitimate Apify actor, suggesting the flaws are unintentional rather than malicious.