ClawHub
Back to skill

Security audit

analyzing-twitter-sentiment-for-topic

Security checks across malware telemetry and agentic risk

Overview

This skill openly uses Apify to collect public Twitter/X posts for sentiment analysis and does not show hidden, destructive, or unrelated behavior.

Before installing, be aware that searches are not local: your topic queries and collected tweet data may be sent to Apify and processed through Twitter/X scraping services. Avoid using sensitive monitoring targets unless that is acceptable for your workflow, and store APIFY_TOKEN carefully.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill directs users to send search terms and retrieve tweet data through Apify/Twitter scraping infrastructure without any explicit notice about third-party processing, retention, or data-handling implications. While the data is intended to be public tweets, user-supplied queries may still reveal sensitive business interests, investigations, or monitoring targets, creating a privacy and confidentiality risk.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The instructions say to ask for language but also set the default to English, which imposes a language choice unless the user overrides it. This is a natural-language locale policy issue because the skill does not present the default as opt-in or justify why English must be assumed.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
95% confidence
Finding
The documented REST fallback explicitly transmits user-provided search terms and authentication context to an external API endpoint. This is expected functionality for the skill, but it is still a real external data-transfer surface that can expose sensitive research interests, leak operational metadata, and increase risk if users assume analysis is local.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "searchTerms": ["[TOPIC_KEYWORD]"],
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.