ClawHub
Back to skill

Security audit

finding-trending-twitter-topics-for-content

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Apify/Twitter research workflow, with the main practical caution that user queries are sent to a third-party service.

Install only if you are comfortable using Apify/apidojo to process your Twitter/X searches. Do not enter secrets, private customer lists, unreleased campaign terms, or sensitive personal data as search terms, and keep the APIFY_TOKEN scoped and protected according to your Apify account practices.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill directs users to run an external Apify actor but does not clearly disclose that search terms and retrieved Twitter/X data are transmitted to a third-party service. This creates a privacy and data-governance risk because users may submit sensitive research topics, customer identifiers, or internal campaign terms without informed consent.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST   "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{
    "searchTerms": ["B2B SaaS", "#saas", "B2B SaaS 2026"],
    "maxItems": 500,
    "tweetLanguage": "en"
Confidence
94% confidence
Finding
The direct reference to https://api.apify.com confirms use of a third-party endpoint. Because this skill is for content ideation rather than a security-sensitive workflow, the risk is contextual and moderate, but users could still unknowingly disclose internal strategy, target accounts, or market-intelligence queries to an external provider.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST   "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{
    "searchTerms": ["B2B SaaS", "#saas", "B2B SaaS 2026"],
    "maxItems": 500,
    "tweetLanguage": "en"
Confidence
94% confidence
Finding
The direct reference to https://api.apify.com confirms use of a third-party endpoint. Because this skill is for content ideation rather than a security-sensitive workflow, the risk is contextual and moderate, but users could still unknowingly disclose internal strategy, target accounts, or market-intelligence queries to an external provider.

Natural-Language Policy Violations

Low
Confidence
85% confidence
Finding
The skill's natural-language examples set `"tweetLanguage": "en"`, which steers usage toward English-only results. Because the documentation does not present this as an optional user choice or justify an English-only constraint, it constitutes a language/locale policy concern.

Natural-Language Policy Violations

Low
Confidence
84% confidence
Finding
The curl example includes `"tweetLanguage": "en"`, which imposes an English locale in the documented workflow. The file does not indicate that users may choose another language or that English is required for a specific justified reason.

Static analysis

No suspicious patterns detected.