ClawHub
Back to skill

Security audit

finding-marketing-professionals-on-twitter

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent recruiting workflow that uses Apify/Twitter scraping as advertised, with credential-handling cautions users should follow.

Before installing, confirm you are comfortable sending recruiting search terms and Twitter/X profile targets to Apify. Store APIFY_TOKEN as a secret, avoid pasting live-token commands into shared logs or chats, prefer safer authentication mechanisms when available, and handle exported candidate CSV/JSON files as recruiting records.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
This markdown skill requires a sensitive credential and later shows it being sent in API requests, but the document does not warn users to protect the token, avoid sharing logs/commands, or understand that requests send account-authorized data to a third-party service. For a skill involving external scraping services, that omission is a missing user warning about privacy and credential exposure risks.

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
This is a natural-language policy issue because the skill constrains results to English by default in its workflow example, which can force a language preference without user opt-in. The document does not explain that the skill is intentionally English-only or provide a way for users to choose another language.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"searchTerms": ["growth marketer", "VP Marketing", "marketing open to work", "content marketing jobs"], "maxItems": 300}'
Confidence
90% confidence
Finding
The REST example places APIFY_TOKEN in the request URL query string, which is prone to leakage via shell history, logs, proxies, browser tooling, and monitoring systems. Although the transmission is to the intended Apify service, embedding secrets in URLs unnecessarily increases credential exposure risk.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["handle1", "handle2"]}'
```
Confidence
91% confidence
Finding
This profile-enrichment REST example again includes APIFY_TOKEN in the URL query string, creating the same secret leakage risk through logs and intermediary systems. Because the skill processes recruiting-target data, the context involves repeated external calls, increasing the chance that unsafe credential patterns are copied into production workflows.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["handle1", "handle2"]}'
```
Confidence
91% confidence
Finding
This profile-enrichment REST example again includes APIFY_TOKEN in the URL query string, creating the same secret leakage risk through logs and intermediary systems. Because the skill processes recruiting-target data, the context involves repeated external calls, increasing the chance that unsafe credential patterns are copied into production workflows.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.