finding-data-scientists-on-twitter

• Outcome: Pass
• Latest audit: Sep 3, 2026 · 6:59 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward recruiting workflow that uses Apify Twitter scrapers, with privacy and data-handling considerations users should understand before use.

Before installing, confirm you are comfortable sending Twitter/X search terms, handles, and collected profile data to Apify/apidojo services. Use only data you are allowed to process for recruiting, avoid sensitive criteria or unnecessary personal data, set reasonable maxItems limits, and choose output filenames/locations deliberately when exporting results.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs users to send search terms, usernames, and scraped profile data to Apify actors using an API token, but it does not clearly warn that recruitment queries and collected candidate information are transmitted to and processed by a third-party service. This can create privacy, compliance, and data-handling risks, especially if users include sensitive sourcing criteria or export candidate datasets without informed consent.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The example input sets "tweetLanguage": "en", which constrains results to English-language content. The document does not present this as optional, offer alternatives, or justify an English-only policy for a region-specific use case.

External Transmission

Medium

• Category: Data Exfiltration

Content

**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"searchTerms": ["data scientist", "ML engineer", "LLM engineer", "machine learning open to work"], "maxItems": 300}'

• Confidence: 95% confidence
• Finding: This curl example transmits recruitment search terms to an external API endpoint using an authentication token, which exposes user intent and potentially sensitive sourcing activity to a third party. Because the skill lacks a warning or consent checkpoint, users may unknowingly disclose internal hiring priorities or regulated personal data through the external service.

External Transmission

Medium

• Category: Data Exfiltration

Content

**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["handle1", "handle2"]}'
```

• Confidence: 93% confidence
• Finding: This endpoint sends lists of usernames to an external scraper service for enrichment, which can reveal candidate pipelines and organizational recruiting focus. The danger is contextual rather than exploitative code execution: the skill operationalizes third-party transfer of profile identifiers without clearly informing users of the disclosure or downstream handling.

External Transmission

Medium

• Category: Data Exfiltration

Content

**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["handle1", "handle2"]}'
```

• Confidence: 93% confidence
• Finding: This endpoint sends lists of usernames to an external scraper service for enrichment, which can reveal candidate pipelines and organizational recruiting focus. The danger is contextual rather than exploitative code execution: the skill operationalizes third-party transfer of profile identifiers without clearly informing users of the disclosure or downstream handling.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The markdown instructs the user to run a helper that 'handles waiting, output, and file saving automatically' and shows examples writing CSV/JSON files. While the examples imply output creation, there is no explicit warning that the skill may write files to disk or overwrite paths the user supplies.

VirusTotal

62/62 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.