ClawHub
Back to skill

Security audit

finding-real-estate-professionals-on-twitter

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent Twitter/X prospecting integration, but it exposes broad social-graph scraping and arbitrary mapping options without enough scoping or user warnings.

Review before installing if you are uncomfortable with broad Twitter/X data collection. Use small maxItems values, avoid follower/following/retweeter scraping unless you have a clear lawful purpose, do not place sensitive prospecting strategy in queries, keep APIFY_TOKEN in a secure secret store, and avoid customMapFunction unless you understand how the upstream actor executes it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The documented capability extends beyond identifying real estate professionals and allows collection of follower lists, following lists, and retweeters, which materially broadens the scope of data collection and surveillance. In a lead-generation skill, this increases privacy and overcollection risk because users may trigger social-graph scraping not disclosed in the high-level manifest.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
Allowing an arbitrary JavaScript customMapFunction introduces a code-injection-like extensibility point that is unnecessary for the stated purpose of finding professionals on Twitter. If executed by the upstream actor or supporting tooling, it could enable unsafe transformation logic, data exfiltration, bypass of intended output constraints, or unexpected execution behavior.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill instructs users to send queries and an authorization token to an external Apify endpoint without clearly warning that search terms, handles, and authentication data will be transmitted to a third-party scraping service. In a prospecting context, this transparency gap can cause accidental disclosure of sensitive inputs or misuse of credentials.

External Transmission

Medium
Category
Data Exfiltration
Content
### REST API fallback

```bash
curl -X POST "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"keywords": ["realtor", "real estate agent"], "maxItems": 100}'
Confidence
86% confidence
Finding
The curl example explicitly transmits data and a bearer token to an external API endpoint. External transmission is expected for this type of integration, but it still represents a real security/privacy concern because users may disclose sensitive search criteria or expose tokens if they do not understand the trust boundary.

External Transmission

Medium
Category
Data Exfiltration
Content
### REST API fallback

```bash
curl -X POST "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"keywords": ["realtor", "real estate agent"], "maxItems": 100}'
Confidence
86% confidence
Finding
The curl example explicitly transmits data and a bearer token to an external API endpoint. External transmission is expected for this type of integration, but it still represents a real security/privacy concern because users may disclose sensitive search criteria or expose tokens if they do not understand the trust boundary.

Intent-Code Divergence

Low
Confidence
90% confidence
Finding
The Inputs table lists parameters such as `startUrls`, `twitterHandles`, and `twitterUserIds`, but does not include `keywords`. The primary run examples at L43-L49 and L58 use `keywords` as the search input, so the documentation actively presents inconsistent intent about how the skill is supposed to operate.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.