finding-designers-and-creatives-on-twitter

• Outcome: Review
• Latest audit: Sep 3, 2026 · 6:36 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for Twitter recruiting, but it teaches unsafe API-token handling and local export of candidate profile data without enough privacy guidance.

Review before installing. Use an environment variable or secret manager for APIFY_TOKEN, avoid commands that put live tokens in URLs, redact logs and transcripts, and treat exported candidate files as personal data: minimize fields, restrict access, and delete them when no longer needed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill requires an APIFY_TOKEN but does not warn users to keep it out of shell history, logs, screenshots, shared commands, or saved artifacts. Because the same document later demonstrates passing the token in a URL query string, the missing guidance materially increases the chance of credential exposure and unauthorized use of the Apify account.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs saving scraped candidate data to CSV/JSON without warning that the output contains personal/profile data such as handles, names, bios, links, and inferred recruiting signals. That omission can lead to unnecessary local retention, oversharing, or downstream processing of personal data without appropriate controls.

External Transmission

Medium

• Category: Data Exfiltration

Content

**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"searchTerms": ["UX designer", "product designer", "portfolio", "[DISCIPLINE] open to work"], "maxItems": 300}'

• Confidence: 97% confidence
• Finding: The skill sends requests to an external service and includes APIFY_TOKEN directly in the URL query string. Query-string secrets are commonly exposed through shell history, process lists, proxy logs, browser history, monitoring tools, and shared transcripts, making credential theft and unauthorized API use more likely.

External Transmission

Medium

• Category: Data Exfiltration

Content

**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["handle1", "handle2"]}'
```

• Confidence: 96% confidence
• Finding: This example again transmits data to Apify while placing APIFY_TOKEN in the URL query string, creating the same credential leakage risk as the earlier curl example. In this step the payload also includes usernames, so credential exposure can combine with personal-data transmission to expand account misuse and privacy impact.

External Transmission

Medium

• Category: Data Exfiltration

Content

**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["handle1", "handle2"]}'
```

• Confidence: 96% confidence
• Finding: This example again transmits data to Apify while placing APIFY_TOKEN in the URL query string, creating the same credential leakage risk as the earlier curl example. In this step the payload also includes usernames, so credential exposure can combine with personal-data transmission to expand account misuse and privacy impact.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The example input specifies "tweetLanguage": "en", which constrains operation to English-language content. Under the language/locale policy, forcing a specific language without opt-in or justification is a natural-language policy concern.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.