ClawHub
Back to skill

Security audit

finding-startup-employees-for-recruiting

Security checks for vulnerabilities and agentic risk

Overview

This skill is clearly a recruiting scraper, but it profiles identifiable social-media users and sends candidate data to Apify without enough privacy, compliance, or retention guardrails.

Review this skill before installing if your recruiting workflow is subject to employment, privacy, platform, or vendor-approval rules. Only use it with authorized Apify access, limit searches to job-related criteria, avoid unnecessary follower/following extraction and bulk exports, and define retention and deletion handling for candidate lists.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill is explicitly designed to collect, score, and export identifiable social media profile data for recruiting, including inferred employment and career-change signals, but it provides no privacy, consent, retention, or lawful-use guidance. That creates a real privacy/compliance risk because users are encouraged to build candidate lists from third-party data without guardrails on permissible use, minimization, or downstream sharing.

Natural-Language Policy Violations

Medium
Confidence
98% confidence
Finding
Hard-coding `tweetLanguage: "en"` creates a biased collection workflow that can systematically exclude non-English candidates without user awareness or justification. This is not a classic exploit path, but it is a genuine security/compliance-quality issue because it can lead to unfair or discriminatory recruiting outcomes in a hiring context.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"searchTerms": ["at [COMPANY]", "engineer at [STARTUP]", "working at [SECTOR] startup"], "maxItems": 300}'
Confidence
83% confidence
Finding
The skill instructs users to transmit search terms and candidate identifiers to a third-party service over an API, which is an external data transfer. In this recruiting context, that is potentially sensitive because the queries and resulting candidate lists may reveal hiring strategy, competitor targeting, or personal data processing, and the skill gives no warning about third-party handling or approval requirements.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["handle1", "handle2"]}'
```
Confidence
81% confidence
Finding
This step sends Twitter usernames to a third-party scraping actor for profile enrichment, which is another real external transmission of identifiable candidate data. In context, this is more sensitive than generic telemetry because it operationalizes bulk profiling for recruiting without any mention of vendor trust, consent, retention, or access restrictions.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["handle1", "handle2"]}'
```
Confidence
81% confidence
Finding
This step sends Twitter usernames to a third-party scraping actor for profile enrichment, which is another real external transmission of identifiable candidate data. In context, this is more sensitive than generic telemetry because it operationalizes bulk profiling for recruiting without any mention of vendor trust, consent, retention, or access restrictions.

Static analysis

No suspicious patterns detected.