ClawHub
Back to skill

Security audit

finding-speaking-opportunities-on-twitter

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Apify/Twitter research workflow, with expected third-party API use but limited privacy and token-handling guidance.

Install only if you are comfortable sending Twitter/X search terms and retrieved public-post data to Apify under your Apify account. Use a scoped Apify token where possible, avoid putting secrets or confidential strategy terms in queries, review Apify dataset retention/deletion settings, and choose local output filenames carefully.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs users to send search queries and retrieve datasets through Apify without clearly warning that user-supplied inputs and collected Twitter data will be transmitted to an external third-party service. This can expose sensitive search terms, internal research topics, or regulated data to an external processor, especially if users assume the skill operates locally.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"searchTerms": ["call for speakers [TOPIC]", "looking for speakers [TOPIC]", "CFP [TOPIC]", "speaker applications [TOPIC]"], "maxItems": 100}'
Confidence
91% confidence
Finding
This command posts data to the Apify API, transmitting user queries and authentication context to an external service. While expected for the integration, it is security-relevant because the skill provides direct exfiltration of user-provided content to a third party without an in-band warning or consent checkpoint.

External Transmission

Medium
Category
Data Exfiltration
Content
Wait for `SUCCEEDED`. Fetch dataset:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"
```

### Step 3: Classify Results
Confidence
90% confidence
Finding
Fetching dataset items from Apify causes retrieved Twitter data to flow through and persist on an external platform, which may include organizer handles, tweet content, and user search context. In the skill's business-research context this is not inherently malicious, but it can still create privacy, compliance, and data-governance risks if users are not warned that remote storage/processing is involved.

External Transmission

Medium
Category
Data Exfiltration
Content
Wait for `SUCCEEDED`. Fetch dataset:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"
```

### Step 3: Classify Results
Confidence
90% confidence
Finding
Fetching dataset items from Apify causes retrieved Twitter data to flow through and persist on an external platform, which may include organizer handles, tweet content, and user search context. In the skill's business-research context this is not inherently malicious, but it can still create privacy, compliance, and data-governance risks if users are not warned that remote storage/processing is involved.

Missing User Warnings

Low
Confidence
89% confidence
Finding
In this markdown file, the examples explicitly show saving output files, which affects user data handling on the local system. The documentation does not include any user-facing warning or disclosure about local file creation, overwriting risks, or where scraped data will be stored.

Static analysis

No suspicious patterns detected.