finding-freelancers-by-skill-on-twitter

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:31 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Twitter/X freelancer-sourcing workflow that uses Apify as expected, but users should handle the Apify token and candidate data carefully.

Install only if you are comfortable sending Twitter/X search terms, handles, and profile data to Apify. Prefer the MCP or a secure API client, avoid putting APIFY_TOKEN in URLs, use a least-privilege token, and verify any local helper script before running it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:88

Finding

Apify API Token Exposed in URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 88–91 and 105–108
Vulnerability Type: API credential exposure through URL query strings
Risk Level: Medium

Vulnerable Code

bash

curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"searchTerms": ["freelance [SKILL]", "[SKILL] for hire", "available for contract [SKILL]"], "maxItems": 300}'

The same insecure pattern is repeated for profile enrichment:

bash

curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["handle1", "handle2"]}'

Technical Analysis

The REST fallback embeds APIFY_TOKEN in the request URL. Although HTTPS protects the URL while it is in transit, query strings may still be recorded by local process inspection, shell tracing, command diagnostics, HTTP infrastructure, server access logs, monitoring platforms, and error-reporting systems.

Expanding the environment variable directly in a curl command-line argument can also expose the complete URL to users or processes capable of observing command-line arguments. This broadens access to the credential beyond the intended API client and service.

Attack Path

1. A user configures APIFY_TOKEN and executes one of the documented REST fallback commands.
2. The shell expands $APIFY_TOKEN into the URL passed as a command-line argument to curl.
3. A local process observer, diagnostic collector, proxy, API access log, or monitoring service records the URL.
4. An attacker with access to that record extracts the token from the token query parameter.
5. The attacker replays the token against Apify endpoints within the token's assigned permissions.

Exploitation depends on an attacker having access to process information or a system that records the U ...[truncated 501 chars]

Remediation

View remediation

Remediation Suggestions

1. Pass the API token through an authorization header supported by Apify instead of a URL query parameter. For example:

   bash

   curl -X POST \
     "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs" \
     -H "Authorization: Bearer $APIFY_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{"searchTerms": ["freelance [SKILL]", "[SKILL] for hire", "available for contract [SKILL]"], "maxItems": 300}'
   

2. Apply the same change to the twitter-user-scraper example.

3. Ensure scripts and troubleshooting instructions never print expanded credentials.

4. Disable shell tracing when commands involving secrets are executed.

5. Store the token in a protected secret manager or environment variable with appropriately restricted access.

6. Use a least-privilege token restricted to only the required Apify operations.

7. Redact query strings and authorization data from application, proxy, and monitoring logs.

8. Rotate any token that may previously have appeared in command histories, process captures, diagnostics, or logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest trigger text lists broad phrases such as 'find contractors available for hire via social signals' and 'find independent workers actively seeking clients' without clear boundaries, exclusions, or negative examples. These phrases could overlap with general recruiting or research requests and make it unclear when this skill should activate instead of another sourcing skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The example workflow hard-codes "tweetLanguage": "en", which constrains results to English without offering the user a language choice or explaining that the skill is intentionally English-only. This is a language/locale policy issue because it imposes a locale default that may exclude relevant non-English candidates.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The skill instructs sending search terms and an API token to a third-party service via a direct REST call. External transmission is expected for this integration, but it is still security-relevant because user queries and account credentials are sent off-platform, and the token is embedded in the URL where it may be logged by shells, proxies, or process monitoring tools.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

REST API fallback:

bash

curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"searchTerms": ["freelance [SKILL]", "[SKILL] for hire", "available for contract [SKILL]"], "maxItems": 300}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

REST API fallback:

bash

curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"searchTerms": ["freelance [SKILL]", "[SKILL] for hire", "available for contract [SKILL]"], "maxItems": 300}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This profile-enrichment request also sends data and includes the API token in the request URL to a third-party endpoint. While consistent with the skill's stated purpose, it increases risk of credential leakage through logs and exposes collected usernames to an external processor, which may be sensitive in some recruiting workflows.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

REST API fallback:

bash

curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["handle1", "handle2"]}'

Static analysis

No suspicious patterns detected.