Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Apify/Twitter scraping workflow for real estate lead discovery, with privacy and scope considerations but no hidden local execution or persistence.
Install only if you are comfortable using Apify to collect public Twitter/X profile data for lead discovery. Set a clear maxItems limit, avoid follower/following/retweeter collection unless specifically needed, and do not use customMapFunction unless you understand exactly what transformation will run.
The documented inputs permit scraping followers, following lists, and retweeters, which materially expands the skill from simple profile discovery into broader social graph collection. That increases data collection scope beyond the declared purpose and can enable bulk profiling or outreach targeting not apparent from the manifest description.
Allowing a user-supplied customMapFunction introduces arbitrary JavaScript transformation capability that exceeds a simple search-and-return skill and can alter, filter, or derive unexpected outputs from scraped data. In agent environments, exposing custom code hooks is dangerous because it can enable unauthorized logic execution paths, hidden data manipulation, or abuse not reflected in the skill description.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs" \
-H "Authorization: Bearer $APIFY_TOKEN" \
-H "Content-Type: application/json" \
-d '{"keywords": ["realtor", "real estate agent"], "maxItems": 100}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs" \
-H "Authorization: Bearer $APIFY_TOKEN" \
-H "Content-Type: application/json" \
-d '{"keywords": ["realtor", "real estate agent"], "maxItems": 100}'
The skill promises a fixed set of returned fields, but the presence of customMapFunction means the actual output can be arbitrarily reshaped. This mismatch weakens trust boundaries for downstream consumers, which may rely on the documented schema and inadvertently process unexpected or over-collected data.
No suspicious patterns detected.