monitoring-brand-mentions-on-twitter

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:19 AM UTC
• Version: 1.0.0

Overview

The skill’s Twitter/X monitoring purpose is coherent, but it documents unsafe credential handling and an arbitrary JavaScript mapping input that users should review before installing.

Review the Apify token handling before use: prefer authorization headers or a scoped secret mechanism instead of token query parameters, use least-privileged tokens, avoid sensitive internal search terms unless needed, and be deliberate about saving tweet exports to local files. Avoid using `customMapFunction` unless you fully trust the code being sent to the actor.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:117

Finding

Apify API Token Exposed Through URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 117–136; vulnerable references at lines 120 and 136
Vulnerability Type: Credential exposure through URL query parameters
Risk Level: Medium

Vulnerable Code

bash

curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "searchTerms": ["[BRAND_TERM]"],
    "maxItems": 500,
    "includeReplies": true,
    "since": "[YYYY-MM-DD]",
    "until": "[YYYY-MM-DD]"
  }'

bash

curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"

Technical Analysis

The documented commands expand the APIFY_TOKEN environment variable directly into request URLs. Although HTTPS encrypts the requests in transit, it does not prevent the fully expanded URLs from being exposed at either endpoint or on the local system.

URLs containing credentials can be captured by process inspection tools, shell tracing, command diagnostics, proxy and gateway access logs, monitoring platforms, HTTP client debugging output, or copied terminal output. Consequently, URL query parameters are an unsafe mechanism for transmitting long-lived authentication credentials.

Authentication is necessary for the Skill's stated Twitter/X monitoring functionality, and sending search terms to the declared Apify service is consistent with that functionality. However, exposing the token in URLs exceeds the minimum disclosure required because Apify authentication can instead be supplied through an HTTP authorization header.

Attack Path

1. A user exports a valid APIFY_TOKEN and executes one of the documented curl commands.
2. The shell expands $APIFY_TOKEN into the complete command-line URL.
3. A local process inspector, shell tracing mechanism, diagnostic collector, proxy, gateway, or URL logging system records the expanded URL.
4. An attacker with a ...[truncated 1067 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the token query parameter from every documented Apify URL.

2. Pass the token through an authorization header supported by Apify:

   bash

   curl -X POST \
     "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs" \
     -H "Authorization: Bearer $APIFY_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{
       "searchTerms": ["[BRAND_TERM]"],
       "maxItems": 500,
       "includeReplies": true,
       "since": "[YYYY-MM-DD]",
       "until": "[YYYY-MM-DD]"
     }'
   

   bash

   curl \
     "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items" \
     -H "Authorization: Bearer $APIFY_TOKEN"
   

3. Verify the exact authorization-header syntax against current Apify documentation before publishing the revised commands.

4. Configure clients, proxies, and monitoring systems to redact authorization headers and sensitive environment variables.

5. Avoid shell tracing such as set -x while handling credentials.

6. Store the token in a restricted secret manager or protected environment configuration rather than command history or source files.

7. Use a least-privileged token limited to the actors, datasets, and operations required by the Skill.

8. Revoke and rotate any token that may previously have appeared in command output, process captures, or URL logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill collects and returns third-party social media content, author handles, timestamps, and engagement data without any explicit notice about privacy, retention, or responsible handling. While the data is public, aggregating and exporting it increases privacy and compliance risk, especially if users save, redistribute, or combine it with other datasets.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documented input surface includes customMapFunction, which allows arbitrary JavaScript to be supplied to the upstream actor. In a brand-monitoring skill, exposing code execution is broader than the stated purpose and can enable data exfiltration, unexpected network access, or abuse of the execution environment if a user or downstream agent passes untrusted code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The workflow explicitly provides commands to save scraped tweet data to CSV and JSON files but does not warn that executing them will write third-party content and metadata to local disk. This can lead to unintentional persistence of collected data, increasing exposure through local compromise, sharing, backups, or later misuse.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

The skill instructs sending search terms and authentication material to an external service via Apify. External transmission is expected for this integration, but it still creates a security boundary crossing where user queries, brand-monitoring targets, and access tokens may be exposed if logged, mishandled, or used in sensitive contexts.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

If Apify MCP is not available:

bash

curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

If Apify MCP is not available:

bash

curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "searchTerms": ["[BRAND_TERM]"],

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Fetching dataset items from Apify transmits and retrieves aggregated tweet data across an external service boundary. In context this is part of the skill's intended operation, but it remains a meaningful data-flow risk because collected content and metadata are being stored and accessed through a third-party platform.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

Step 3: Fetch and Merge Results

bash

curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"

Merge datasets from all runs. Deduplicate by tweet id. Result: unified list of all mentions.

Static analysis

No suspicious patterns detected.