ClawHub
Back to skill

Security audit

discovering-pre-launch-startups-on-twitter

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Twitter/X research scraper workflow that uses Apify and has expected privacy considerations but no hidden or destructive behavior.

Install only if you are comfortable sending Twitter/X search terms and related Apify usage metadata to Apify. Confirm Twitter/X scraping is intended for broad startup-research requests, keep APIFY_TOKEN scoped and private, and save CSV/JSON outputs only where research data may be retained.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger description is broad enough to match common research or competitive-intelligence requests, which can cause the skill to activate unexpectedly and send user queries to an external scraping service. This is dangerous because it increases the chance of unintended third-party data transmission and execution of the skill when the user did not clearly consent to using Twitter scraping infrastructure.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill explicitly documents saving output to local CSV/JSON files but does not include a user-facing warning or consent step before writing data. This can lead to unexpected persistence of scraped or potentially sensitive research results on disk, creating privacy, retention, and workspace data-leakage risks.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"searchTerms": ["launching soon [SECTOR]", "beta waitlist [SECTOR]", "building [SECTOR] product", "#buildinpublic [SECTOR]", "soft launch [SECTOR]"], "maxItems": 100}'
Confidence
93% confidence
Finding
This skill sends user-supplied search terms to an external Apify endpoint, which is a real external data transmission. In context, the transmission is core to the skill's purpose, but it is still security-relevant because user research topics, search strategies, and API token usage are exposed to a third-party service.

External Transmission

Medium
Category
Data Exfiltration
Content
Wait for `SUCCEEDED`. Fetch dataset:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"
```

### Step 3: Classify Results
Confidence
87% confidence
Finding
Fetching dataset items from the external Apify API is another real third-party transmission that may expose run identifiers, output data, and token-authenticated access patterns. While expected for the skill, it still creates confidentiality and data-governance risk if users are not informed that both submission and retrieval occur through an external service.

External Transmission

Medium
Category
Data Exfiltration
Content
Wait for `SUCCEEDED`. Fetch dataset:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"
```

### Step 3: Classify Results
Confidence
87% confidence
Finding
Fetching dataset items from the external Apify API is another real third-party transmission that may expose run identifiers, output data, and token-authenticated access patterns. While expected for the skill, it still creates confidentiality and data-governance risk if users are not informed that both submission and retrieval occur through an external service.

Static analysis

No suspicious patterns detected.