Social Media Scraper

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:42 AM UTC
• Version: 1.0.0

Overview

This is a disclosed documentation-only skill for using EnsembleData's social-media API, with notable credential-handling and compliance cautions but no hidden execution, persistence, or deceptive behavior found.

Install only if you are comfortable sending your EnsembleData token and requested social-media targets to EnsembleData. Avoid putting real tokens in shared URLs, logs, screenshots, notebooks, or source code; prefer environment variables, log redaction, token rotation, and pinned SDK versions. Use the scraping endpoints only for lawful, public-data use cases and handle comments, profile details, and contact/business data according to applicable platform terms and privacy rules.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:10

Finding

API Credentials Transmitted in URL Query Strings

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:10
• SKILL.md:58-62
• tiktok.md:5
• tiktok.md:33-35
• tiktok.md:128-130
• instagram.md:5
• instagram.md:39-41
• reddit.md:5
• reddit.md:31-33
• youtube.md:5
• youtube.md:28-30

Vulnerability Type: API credential exposure through URL query parameters
Risk Level: Medium

Vulnerable Code

SKILL.md:10:

markdown

**Authentication:** Every request must include `?token=YOUR_TOKEN`. Tokens are 12–24 characters long and are assigned on signup.

SKILL.md:58-62:

python

res = requests.get("https://ensembledata.com/apis/customer/get-used-units", params={
    "date": "2024-01-15",
    "token": "YOUR-TOKEN"
})

tiktok.md:33-35:

python

res = requests.get("https://ensembledata.com/apis/tt/hashtag/posts", params={
    "name": "magic", "cursor": 0, "token": "YOUR-TOKEN"
})

tiktok.md:128-130:

python

res = requests.get("https://ensembledata.com/apis/tt/user/info", params={
    "username": "daviddobrik", "token": "YOUR-TOKEN"
})

instagram.md:39-41:

python

res = requests.get("https://ensembledata.com/apis/instagram/user/basic-stats", params={
    "username": "natgeo", "token": "YOUR-TOKEN"
})

reddit.md:31-33:

python

res = requests.get("https://ensembledata.com/apis/reddit/keyword/search", params={
    "name": "machine learning", "token": "YOUR-TOKEN"
})

youtube.md:28-30:

python

res = requests.get("https://ensembledata.com/apis/youtube/keyword/search", params={
    "name": "python tutorial", "token": "YOUR-TOKEN"
})

Technical Analysis

The Skill consistently instructs users to transmit the EnsembleData API token as a token URL query parameter. Authentication is necessary for the declared social-media scraping functionality, and the requests use HTTPS to the disclosed ensembledata.com service. Therefore, t ...[truncated 1833 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer an HTTP authorization header, such as:

   python

   headers = {"Authorization": f"Bearer {token}"}
   res = requests.get(
       "https://ensembledata.com/apis/customer/get-used-units",
       params={"date": "2024-01-15"},
       headers=headers,
       timeout=30
   )
   

2. If EnsembleData only accepts query-string authentication, explicitly document that users must:

   • Disable or sanitize full-URL request logging.
   • Redact the token parameter in proxy, CDN, API gateway, and observability logs.
   • Avoid sharing request URLs, screenshots, traces, and exception output containing tokens.
   • Load tokens from a secret manager or protected environment variable rather than embedding them in source code.
   • Use separate tokens for development and production where supported.
   • Rotate any token that may have appeared in logs or shared URLs.

3. The service should support short-lived, scoped credentials and authorization headers so that clients do not need to place long-lived secrets in URLs.

4. Documentation examples should use a variable such as os.environ["ENSEMBLEDATA_TOKEN"] and include explicit credential-handling warnings.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:81

Finding

Unpinned Third-Party SDK Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:81-89
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

pip install ensembledata

python

from ensembledata.api import EDClient
client = EDClient("YOUR-TOKEN")
result = client.tiktok.user_info_from_username(username="daviddobrik")
print(result.data)
print("Units charged:", result.units_charged)

Technical Analysis

The Skill instructs users to install the mutable latest release of the ensembledata package without a pinned version, lockfile, or integrity hash. Consequently, the code installed during a future invocation may differ from the code reviewed when the Skill was published.

Python packages can execute code during installation or when imported and used. If the package publisher account, distribution infrastructure, or a future release is compromised, following this instruction could introduce attacker-controlled code into the agent environment. The audit found no evidence that the currently referenced package is malicious; the confirmed issue is the unsafe, non-reproducible dependency installation practice.

Attack Path

1. An attacker compromises the package publisher account, package repository path, or release process.
2. The attacker publishes a malicious release under the expected package name.
3. A user follows pip install ensembledata without selecting a previously reviewed version.
4. The package manager resolves and installs the attacker-controlled latest release.
5. Malicious code executes during package installation, import, or SDK use.
6. That code operates with the privileges of the user or agent process that invoked the package manager.

Impact Assessment

A malicious dependency could obtain the full privileges of the installing or executing process. Depending on the runtime environment, this could include reading accessible files and envir ...[truncated 425 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the SDK to a specifically reviewed version rather than installing the mutable latest release:

   bash

   python -m pip install "ensembledata==REVIEWED_VERSION"
   

2. Use a requirements or lock file with cryptographic hashes:

   text

   ensembledata==REVIEWED_VERSION --hash=sha256:VERIFIED_PACKAGE_HASH
   

   Install it using:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Verify the package publisher, package-index location, source repository, release signature, and artifact hash before recommending a version.

4. Install the dependency in an isolated virtual environment or restricted container under a non-privileged user.

5. Prevent the package installation and runtime environment from accessing unrelated secrets. Provide the EnsembleData token only to the process that needs it and only when making the required API request.

6. Add automated dependency scanning and a controlled update process so new versions are reviewed before changing the pinned dependency.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documents use of a third-party social media scraping API but does not clearly warn users that their authentication token and the social-media targets or query parameters they submit will be transmitted to an external service. This creates a privacy and trust risk because users may unknowingly send sensitive operational data, account identifiers, or research targets to a vendor outside the primary system boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill explicitly promotes scraping Instagram content, comments, and detailed profile/business data while providing no warning about privacy expectations, platform terms, or downstream handling of collected personal data. This creates a real compliance and privacy risk because users may deploy the skill to collect and process personal information at scale without understanding legal, contractual, or ethical constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs users to pass the API token as a URL query parameter on every request (?token=YOUR_TOKEN). Query parameters are commonly captured in browser history, proxy logs, analytics systems, server access logs, referrer headers, and debugging output, which increases the chance of credential leakage beyond the intended recipient. Because this is an API usage guide, the pattern is contextual and directly encourages insecure credential handling rather than being an incidental example.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly instructs users to pass the API token as a query parameter on every request, which increases the chance of credential leakage through logs, browser history, proxy caches, analytics systems, referrer headers, and copied URLs. Because this is documentation for routine API usage, the insecure pattern is likely to be widely replicated by users and agents, making accidental exposure more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation explicitly instructs users to pass the API token as a query parameter on every request. Query-string credentials are more likely to be exposed through logs, browser history, proxy records, analytics systems, referrer leakage, and copied URLs, which increases the chance of credential disclosure even when HTTPS is used. In this context the file is API usage documentation, so the risk is real but limited to token exposure rather than direct code execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.