ClawHub
Back to skill

Security audit

monitoring-vc-investor-activity-on-twitter

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Apify/Twitter monitoring workflow, but users should handle the Apify token carefully.

Install only if you are comfortable using Apify to scrape Twitter/X data. Store APIFY_TOKEN as a secret, avoid commands that put the token in URLs or shared logs, prefer MCP/SDK/header-based authentication, and set reasonable maxItems limits to control cost and data volume.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"searchTerms": ["investing in [SECTOR]", "excited about [SECTOR]", "looking for [SECTOR] startups", "portfolio company [SECTOR]"], "maxItems": 100}'
Confidence
95% confidence
Finding
This example transmits the APIFY_TOKEN to an external API in the URL query string, which is prone to leakage through shell history, terminal scrollback, proxy logs, browser/server logs, and process inspection. The external transmission is expected for the skill's function, but embedding the secret in the URL makes the pattern materially less safe than necessary.

External Transmission

Medium
Category
Data Exfiltration
Content
Wait for `SUCCEEDED`. Fetch dataset:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"
```

### Step 3: Classify Results
Confidence
94% confidence
Finding
This dataset retrieval example again puts APIFY_TOKEN in the URL query string, creating the same credential exposure risk during external transmission. Because the skill is designed to fetch remote datasets, this behavior is contextually expected, but the token-in-URL pattern is still unsafe and can enable unauthorized use of the Apify account if the token is leaked.

External Transmission

Medium
Category
Data Exfiltration
Content
Wait for `SUCCEEDED`. Fetch dataset:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"
```

### Step 3: Classify Results
Confidence
94% confidence
Finding
This dataset retrieval example again puts APIFY_TOKEN in the URL query string, creating the same credential exposure risk during external transmission. Because the skill is designed to fetch remote datasets, this behavior is contextually expected, but the token-in-URL pattern is still unsafe and can enable unauthorized use of the Apify account if the token is leaked.

Missing User Warnings

Low
Confidence
91% confidence
Finding
The skill requires an APIFY_TOKEN and includes examples that pass it to external services, but it does not warn users that this is a sensitive credential or advise against exposing it in logs, shell history, or shared output. While the token use itself is expected for Apify integration, the missing credential-handling guidance increases the risk of accidental disclosure.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.