Apify Substack Scraper

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Running the skill may consume Apify resources and use whatever permissions the supplied APIFY_TOKEN has.

Why it was flagged

The skill needs an Apify credential to run and fetch actor results. This is expected for the stated Apify scraper purpose, but it gives the workflow access to the user's Apify account capabilities and credits.

Skill content
Requires APIFY_TOKEN environment variable.
Recommendation

Use a token with the minimum practical Apify permissions, keep it secret, and confirm the scrape parameters before running the actor.

What this means

The remote actor controls the actual scraping behavior and may change independently of this instruction-only skill.

Why it was flagged

The skill depends on a fixed remote Apify Actor whose implementation is not included in the provided artifacts. That is normal for an Apify-based skill, but users must trust the remote actor.

Skill content
Actor ID
`BULaGFURBV7WG3K81`
Recommendation

Before installing or using, verify the Apify Actor's publisher, permissions, pricing, and current behavior in Apify.

What this means

Substack URLs, scrape settings, and scraped results may be processed by Apify under the user's account.

Why it was flagged

The workflow sends scrape inputs to Apify and retrieves dataset items through Apify's API. This external provider data flow is disclosed and purpose-aligned.

Skill content
curl -s -X POST "https://api.apify.com/v2/acts/BULaGFURBV7WG3K81/run-sync-get-dataset-items?token=$APIFY_TOKEN"
Recommendation

Only submit URLs and content you are comfortable processing through Apify, and review Apify's dataset retention and access controls.