ClawHub
Back to skill

Security audit

building-journalist-outreach-list-from-twitter

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Apify/Twitter workflow for finding journalist contacts, with credential-handling and language-scope caveats but no hidden or destructive behavior found.

Before installing, be aware that this skill sends your search terms and selected Twitter/X usernames to Apify and requires an APIFY_TOKEN. Keep that token private, avoid pasting commands where URLs may be logged or shared, and adjust the language/geography settings if you need non-English or non-US journalist discovery.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The workflow specifies `tweetLanguage: "en"`, which forces a specific language during journalist discovery. Because the skill otherwise describes optional geographies including global use, this English-only constraint is a locale/language policy issue unless users are given an explicit choice or the restriction is clearly justified.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
This markdown file includes curl examples that embed `$APIFY_TOKEN` directly into API request URLs and explicitly requires the `APIFY_TOKEN` environment variable. The skill description does not provide any warning about credential sensitivity, token handling, or avoiding exposure in logs/history, despite involving access to a secret needed for external network calls.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "searchTerms": ["[TOPIC] journalist", "[TOPIC] reporter", "writing about [TOPIC]"],
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "searchTerms": ["[TOPIC] journalist", "[TOPIC] reporter", "writing about [TOPIC]"],
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.