Creator Screening

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:25 AM UTC
• Version: 1.1.0

Overview

The skill largely performs the stated creator-screening workflow, but it includes biased rejection criteria and a real credential-handling weakness that users should review before installing.

Install only if you are comfortable sending creator URLs, profile metadata, captions, and transcript or video-analysis requests to Memories.ai and optionally Apify. Use dedicated least-privilege API keys, avoid the Apify fallback until token handling is fixed, and review or replace the CAC Crusher framework criteria before using it for real creator approval decisions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/scrape_profiles.py:96

Finding

Apify API Token Exposed in URL Query String

Content

View full analysis

Vulnerability Details

File Location: scripts/scrape_profiles.py, line 96
Vulnerability Type: Credential exposure through a URL query parameter
Risk Level: Medium

Vulnerable Code

python

url = f'https://api.apify.com/v2/acts/apify~instagram-profile-scraper/run-sync-get-dataset-items?token={APIFY_KEY}'

Technical Analysis

The script embeds APIFY_API_KEY directly in the request URL. HTTPS encrypts the request while it is in transit, but it does not prevent the complete URL from being retained by application diagnostics, server access logs, reverse proxies, API gateways, monitoring products, or exception-reporting systems.

This method exposes the credential to more systems and operators than necessary. The API token should instead be transmitted through an authorization header so it is less likely to be captured by URL-oriented logging.

The fallback request itself is consistent with the Skill’s declared creator-screening functionality and does not constitute an unauthorized privilege escalation. The vulnerability is specifically the insecure credential transport mechanism.

Attack Path

1. A user configures APIFY_API_KEY and invokes username-based profile scraping.
2. The script interpolates the plaintext API token into the Apify request URL.
3. A server, proxy, gateway, debugging facility, or monitoring system records the complete URL.
4. An attacker or unauthorized operator with access to those records extracts the token.
5. The attacker reuses the token against Apify within the permissions and account limits assigned to it.

Impact Assessment

A leaked token could allow unauthorized use of the victim’s Apify account capabilities, including execution of actors and consumption of paid resources, subject to the token’s configured permissions. This may cause financial loss, quota exhaustion, unauthorized data access, or disruption of legitimate scraping tasks.

The issue does not expose local system privileges by itsel ...[truncated 90 chars]

Remediation

View remediation

Remediation Suggestions

• Use Apify’s supported authorization header rather than a query parameter:

python

url = 'https://api.apify.com/v2/acts/apify~instagram-profile-scraper/run-sync-get-dataset-items'
req = urllib.request.Request(url, data=data, method='POST')
req.add_header('Authorization', f'Bearer {APIFY_KEY}')
req.add_header('Content-Type', 'application/json')

• Ensure logs and exception handlers never record authorization headers or credential-bearing URLs.
• Apply least privilege to the Apify token and restrict its permissions where supported.
• Rotate any token previously used by this implementation if request URLs may have been logged.
• Use separate tokens for development and production and monitor for unexpected actor executions or resource consumption.
• Add an automated test that rejects outbound URLs containing sensitive parameter names such as token, api_key, or secret.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tainted flow: 'req' from os.environ.get (line 99, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/scrape_profiles.py (reported line 24)May include surrounding context.

python

req = urllib.request.Request(url, data=data, method='POST')
    req.add_header('Authorization', MAVI_KEY)
    req.add_header('Content-Type', 'application/json')
    resp = urllib.request.urlopen(req, timeout=60)
    result = json.loads(resp.read())
    if result.get('code') == '0000':
        return result.get('data', {}).get('data', {}).get('xdt_shortcode_media', {})

Tainted flow: 'req' from os.environ.get (line 99, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

The Apify API token is embedded directly into the request URL query string, which is more easily exposed through logs, proxies, monitoring systems, browser/history artifacts, and error messages than a header-based secret. In this skill context, the script sends creator-screening requests to a third-party service, so accidental credential leakage could let others invoke the Apify actor or access related account resources.

Content

Scanner excerpt · scripts/scrape_profiles.py (reported line 101)May include surrounding context.

python

data = json.dumps(body).encode()
    req = urllib.request.Request(url, data=data, method='POST')
    req.add_header('Content-Type', 'application/json')
    resp = urllib.request.urlopen(req, timeout=300)
    raw = json.loads(resp.read())
    
    results = {}

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

This mismatch includes use of an undeclared external scraping fallback service, which creates a security and privacy concern beyond simple overclaiming. Users may believe only one vendor/API is involved, while creator data could be sent to another third party without explicit disclosure or scoped permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This mismatch includes use of an undeclared external scraping fallback service, which creates a security and privacy concern beyond simple overclaiming. Users may believe only one vendor/API is involved, while creator data could be sent to another third party without explicit disclosure or scoped permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This mismatch includes use of an undeclared external scraping fallback service, which creates a security and privacy concern beyond simple overclaiming. Users may believe only one vendor/API is involved, while creator data could be sent to another third party without explicit disclosure or scoped permissions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The framework explicitly treats 'rural/farm-like' and 'visibly unpolished' environments as automatic rejection criteria, which encodes locale- and class-based bias into creator screening. In this skill's context, those criteria directly drive approval decisions, creating a material risk of discriminatory filtering unrelated to objective production quality or advertiser fit.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This section repeats 'rural-style settings' and 'low-production aesthetics' as negative signals, reinforcing a biased rule set that can systematically exclude creators based on socioeconomic or geographic cues rather than performance. Because the skill is specifically designed to vet influencers at scale, embedding these criteria increases the likelihood of broad discriminatory outcomes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Listing 'rural or visibly low-production aesthetics' as a core reject signal makes exclusion of rural-coded creators an explicit policy objective, not an incidental artifact. In a creator-screening framework, this is especially dangerous because it operationalizes biased selection criteria into downstream business decisions and can cause systematic disparate impact.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill documents use of environment variables, networked third-party APIs, and likely report/file generation, but it does not declare any explicit tool scope or permission boundaries. That makes the skill harder to govern and audit, and could allow execution in contexts where users or the platform are unaware that external network access and data handling are required.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Broad trigger phrases can cause the skill to activate for generic requests and process sensitive creator data or invoke external services unexpectedly. In a skill that performs network calls and third-party analysis, overbroad routing increases the chance of unintended data disclosure and misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly describes sending creator profile data, video URLs/content, and transcripts to external APIs, but it does not present a clear user-facing privacy notice or third-party data handling warning. This is dangerous because social/media content, profile metadata, and derived transcripts may be personal or sensitive data, and users may not realize they are exporting it to external vendors.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/scrape_profiles.py (reported line 96)May include surrounding context.

python

print("APIFY_API_KEY not set, cannot use fallback", file=sys.stderr)
        return {}
    
    url = f'https://api.apify.com/v2/acts/apify~instagram-profile-scraper/run-sync-get-dataset-items?token={APIFY_KEY}'
    body = {"usernames": usernames, "resultsLimit": 1}
    data = json.dumps(body).encode()
    req = urllib.request.Request(url, data=data, method='POST')

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This code performs a file write when --output is provided, but there is no confirmation prompt or explicit user-facing warning in comments/docstrings about overwriting or creating a file. For a code-file review under SQP-2, file writes can be flagged when they lack disclosure and are not otherwise warned about in the file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script writes collected creator profile data to the path supplied by --output, but the only surrounding text is a generic usage docstring and argument help. There is no confirmation prompt or explicit warning that the file will be created or overwritten, which is a safety-relevant file write under the code-file criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.