finding-speaking-opportunities-on-twitter

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:19 AM UTC
• Version: 1.0.0

Overview

The skill does what it says, but its fallback API commands put the Apify token in URLs, which can expose the credential in logs or process output.

Review before installing if you plan to use the REST fallback. Prefer the MCP or a helper that keeps the token in protected environment handling, use a narrowly scoped Apify token, avoid logging commands containing credentials, and treat saved result files as locally persisted scraped data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:98

Finding

Apify API Token Exposed in URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 98–107
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: Medium

bash

curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"searchTerms": ["call for speakers [TOPIC]", "looking for speakers [TOPIC]", "CFP [TOPIC]", "speaker applications [TOPIC]"], "maxItems": 100}'

Wait for SUCCEEDED. Fetch dataset:

bash

curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"

Technical Analysis

The documented REST fallback interpolates APIFY_TOKEN directly into the request URL. Sending a credential to the declared Apify service is necessary for this Skill's functionality, but placing it in a query parameter is not the minimum-risk authentication method.

Query strings are commonly recorded by HTTP access logs, reverse proxies, observability platforms, command tracing, diagnostic output, and process-monitoring tools. The expanded URL may also be exposed to other local users through process inspection while curl is running. Consequently, infrastructure or users that do not require access to the credential may receive it.

This is a credential-handling weakness rather than evidence of intentional exfiltration: the destination is the expected api.apify.com service, and the audited file contains no hidden secondary recipient.

Attack Path

1. A user or Agent follows the documented REST fallback with a valid APIFY_TOKEN.
2. The shell expands the environment variable into the curl URL.
3. The complete URL, including the token, becomes visible through process inspection, verbose command telemetry, proxy logs, server access logs, or diagnostic records.
4. An attacker or unauthorized operator with access to one of those sources extracts the token.
5. The attacker submits authenticated r ...[truncated 709 chars]

Remediation

View remediation

Remediation Suggestions

• Replace query-string authentication with Apify's supported authorization-header mechanism, for example:

  bash

  curl -X POST \
    "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs" \
    -H "Authorization: Bearer $APIFY_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{"searchTerms": ["call for speakers [TOPIC]", "looking for speakers [TOPIC]", "CFP [TOPIC]", "speaker applications [TOPIC]"], "maxItems": 100}'
  

  Fetch datasets using the same header-based approach:

  bash

  curl \
    "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items" \
    -H "Authorization: Bearer $APIFY_TOKEN"
  

• Confirm the exact header syntax against the current official Apify API documentation before publishing the revised commands.

• Use a narrowly scoped token with only the permissions required to run the specified Actor and retrieve its resulting dataset.

• Avoid printing, tracing, or logging commands and headers containing credentials. Configure CI, proxy, and observability systems to redact authorization values.

• Load the token from a protected secret store or environment variable and never place it in generated output files.

• Rotate any token previously used in query parameters if logs or telemetry may have retained the complete URLs.

• Set conservative usage limits and monitor Actor execution for unexpected requests or quota consumption.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This command sends user-provided search terms and the APIFY_TOKEN to an external third-party service, creating a clear data exfiltration boundary. In an agent workflow, transmitting prompts, search intent, or other embedded sensitive data to Apify without explicit consent can expose confidential information and also risks token leakage through command history, logs, or process inspection because the token is embedded in the URL.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

REST API fallback:

bash

curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"searchTerms": ["call for speakers [TOPIC]", "looking for speakers [TOPIC]", "CFP [TOPIC]", "speaker applications [TOPIC]"], "maxItems": 100}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

The documented REST API fallback directs execution against an external Apify endpoint, meaning search content and related parameters are transmitted outside the local environment. While external API use is expected for this skill, the security issue is the lack of strong user-facing consent and boundary disclosure around third-party data transmission.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

REST API fallback:

bash

curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"searchTerms": ["call for speakers [TOPIC]", "looking for speakers [TOPIC]", "CFP [TOPIC]", "speaker applications [TOPIC]"], "maxItems": 100}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

Fetching dataset items from the external Apify endpoint continues the same external data flow and may retrieve scraped content into the local environment without clear safeguards on handling, retention, or downstream use. The inclusion of the token in the request URL also increases exposure risk through logs, browser history, shell history, and intermediary tooling.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

Wait for SUCCEEDED. Fetch dataset:

bash

curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"

Step 3: Classify Results

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly documents commands that save output to local files, but it does not clearly warn the user that executing those examples will write data to disk. In an agent setting, implicit file creation can surprise users, overwrite existing files, or persist scraped data in ways that violate user expectations or local data-handling policies.

Content

No source excerpt is available for this finding.