ClawHub
Back to skill

Security audit

finding-software-engineers-on-twitter

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Twitter/X recruiting workflow using Apify, with no hidden code, but it handles API credentials and candidate profile data that users must control.

Use this only if you are approved to send recruiting searches and Twitter/X usernames to Apify and to process public profile data for hiring. Store APIFY_TOKEN securely, avoid exposing it in command history or logs, verify any local helper script before running it, limit result volumes and exports, and delete or protect candidate files according to your privacy and recruiting policies.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill requires an APIFY_TOKEN and demonstrates sending it to a third-party API, but it does not clearly warn users that credentials and search inputs are being transmitted outside the local environment. This can lead to inadvertent credential mishandling or use in environments where third-party transmission is not approved.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The skill instructs users to export scraped candidate information to CSV/JSON files without any notice that the output contains personal/profile data and may require controlled storage. This increases the risk of unnecessary retention, insecure local storage, or downstream sharing of candidate data outside recruiting compliance processes.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
SQP-3 applies to all file types and covers language/locale policy violations. The example constrains results to English only, which imposes a locale choice without opt-in and may exclude other languages without explanation.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"searchTerms": ["Python engineer", "senior Python developer", "built with Python"], "maxItems": 300}'
Confidence
96% confidence
Finding
The skill includes a concrete example of transmitting search terms and an APIFY_TOKEN to an external third-party service. External transmission is expected for this workflow, but the use of a token in the request URL is risky because query parameters are often logged by shells, proxies, server access logs, and observability systems.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["handle1", "handle2"]}'
```
Confidence
95% confidence
Finding
This second REST example sends usernames and an APIFY_TOKEN to a third-party API and again places the token in the URL. That creates exposure through logs and intermediaries, and the transmitted usernames/profile targets may also be sensitive in some recruiting contexts.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["handle1", "handle2"]}'
```
Confidence
95% confidence
Finding
This second REST example sends usernames and an APIFY_TOKEN to a third-party API and again places the token in the URL. That creates exposure through logs and intermediaries, and the transmitted usernames/profile targets may also be sensitive in some recruiting contexts.

Static analysis

No suspicious patterns detected.