T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:30- Finding
APIFY_TOKEN Exposed Through URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
Apify HN Scraper
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it says: it uses an Apify token to scrape Hacker News, with some credential-handling and input-safety cautions users should understand.
Install only if you are comfortable sending Hacker News search parameters to Apify and using an Apify token from the agent environment. Prefer a narrowly scoped token, avoid logging full curl commands, and update the commands to use an Authorization header plus jq-built JSON before using this with sensitive terms or shared systems.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:20- Finding
Unsafe User Input Substitution in Shell and JSON Request Template
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The description says to use the skill when the user asks to "search HN, find Hacker News posts, monitor tech discussions, or extract HN data." Phrases like "monitor tech discussions" are broad and lack clear scope or exclusion conditions, which could cause unintended invocation for general tech-monitoring requests not specifically about Hacker News.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The presence of a direct HTTPS call to api.apify.com confirms that the skill relies on an external service, which is a legitimate but real security-relevant data egress path. In this context, the danger is not the domain itself but the combination of third-party transmission and URL-based token handling.
- Content
Step 2: Run the Actor
bash RESULT=$(curl -s -X POST "https://api.apify.com/v2/acts/0UDODOnpTkxY3Oc90/run-sync-get-dataset-items?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"searchTerms": ["TERM"], "maxResults": 30}') echo "$RESULT" | jq '.'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The presence of a direct HTTPS call to api.apify.com confirms that the skill relies on an external service, which is a legitimate but real security-relevant data egress path. In this context, the danger is not the domain itself but the combination of third-party transmission and URL-based token handling.
- Content
Step 2: Run the Actor
bash RESULT=$(curl -s -X POST "https://api.apify.com/v2/acts/0UDODOnpTkxY3Oc90/run-sync-get-dataset-items?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"searchTerms": ["TERM"], "maxResults": 30}') echo "$RESULT" | jq '.'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This external call initiates an actor run against a third-party API and therefore constitutes genuine outbound transmission of user-requested data. Because the token is again placed in the URL, the skill increases the attack surface for secret leakage beyond the intended external processing.
- Content
Step 3: Poll and fetch (if async)
bash RUN_ID=$(curl -s -X POST "https://api.apify.com/v2/acts/0UDODOnpTkxY3Oc90/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"searchTerms": ["TERM"], "maxResults": 100}' | jq -r '.data.id') curl -s "https://api.apify.com/v2/actor-runs/$RUN_ID?token=$APIFY_TOKEN" | jq -r '.data.status'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This external call initiates an actor run against a third-party API and therefore constitutes genuine outbound transmission of user-requested data. Because the token is again placed in the URL, the skill increases the attack surface for secret leakage beyond the intended external processing.
- Content
Step 3: Poll and fetch (if async)
bash RUN_ID=$(curl -s -X POST "https://api.apify.com/v2/acts/0UDODOnpTkxY3Oc90/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"searchTerms": ["TERM"], "maxResults": 100}' | jq -r '.data.id') curl -s "https://api.apify.com/v2/actor-runs/$RUN_ID?token=$APIFY_TOKEN" | jq -r '.data.status'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
Polling the actor-run status is an external network operation to Apify, but it appears to send minimal new user data beyond the run identifier. The main concern remains that the APIFY_TOKEN is in the URL, which can leak through logs even in low-sensitivity status checks.
- Content
RUN_ID=$(curl -s -X POST "https://api.apify.com/v2/acts/0UDODOnpTkxY3Oc90/runs?token=$APIFY_TOKEN"
-H "Content-Type: application/json"
-d '{"searchTerms": ["TERM"], "maxResults": 100}' | jq -r '.data.id') curl -s "https://api.apify.com/v2/actor-runs/$RUN_ID?token=$APIFY_TOKEN" | jq -r '.data.status' curl -s "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN" | jq '.'text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
Fetching dataset items from Apify retrieves externally processed results and again authenticates with a URL token. This reinforces that the skill sends and receives data through a third-party boundary, and the URL-based secret handling makes accidental credential disclosure more likely.
- Content
-H "Content-Type: application/json"
-d '{"searchTerms": ["TERM"], "maxResults": 100}' | jq -r '.data.id') curl -s "https://api.apify.com/v2/actor-runs/$RUN_ID?token=$APIFY_TOKEN" | jq -r '.data.status' curl -s "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN" | jq '.'text ### Step 4: Present results
Static analysis
No suspicious patterns detected.