ClawHub
Back to skill

Security audit

monitoring-trending-topics-twitter-by-niche

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Apify Twitter/X scraper workflow, with some credential-handling cautions but no hidden or purpose-mismatched behavior.

Install only if you are comfortable giving the skill access to your Apify account token and sending your chosen Twitter/X search terms to Apify. Prefer the MCP or client-based path, keep APIFY_TOKEN in an environment variable or secret manager, and avoid pasting token-bearing curl commands into logs or shared chats.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The manifest says the skill returns trending topics, tweet velocity, engagement signals, and top voices. In the file, the concrete executable behavior shown is invoking `apidojo~tweet-scraper` to fetch tweets, while the later 'classification' and 'score' sections are only descriptive formulas with no actual implementation that computes trends over time or identifies top voices.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"searchTerms": ["[NICHE]", "#[niche]trending", "[NICHE] breaking"], "maxItems": 100}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Wait for `SUCCEEDED`. Fetch dataset:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"
```

### Step 3: Classify Results
Confidence
83% confidence
Finding
The dataset fetch example embeds APIFY_TOKEN in the URL query string, which is dangerous because query parameters are commonly captured in shell history, process listings, proxy logs, browser history, CI logs, and server access logs. Even if sent to a legitimate endpoint, leaking a live API token can allow unauthorized use of the associated Apify account.

External Transmission

Medium
Category
Data Exfiltration
Content
Wait for `SUCCEEDED`. Fetch dataset:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"
```

### Step 3: Classify Results
Confidence
83% confidence
Finding
The dataset fetch example embeds APIFY_TOKEN in the URL query string, which is dangerous because query parameters are commonly captured in shell history, process listings, proxy logs, browser history, CI logs, and server access logs. Even if sent to a legitimate endpoint, leaking a live API token can allow unauthorized use of the associated Apify account.

Missing User Warnings

Low
Confidence
80% confidence
Finding
The skill requires an APIFY_TOKEN but gives no guidance on secure handling, storage, redaction, or avoiding exposure in logs and shell history. While this is not credential exfiltration by itself, normalizing unsafe secret usage increases the chance that users disclose API tokens during execution or troubleshooting.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.