ClawHub
Back to skill

Security audit

scraping-twitter-list-members

Security checks across malware telemetry and agentic risk

Overview

This skill clearly does what it claims: it helps a user scrape public Twitter/X list member profile data through Apify, with some privacy and data-handling caveats.

Before installing, confirm you are comfortable sending Twitter/X list URLs to Apify and storing exported profile data locally. Use this only for public lists, limit collection to what you need, protect CSV/JSON exports, and check platform terms and applicable privacy rules for outreach or intelligence use.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill explicitly encourages exporting scraped profile data to local CSV/JSON files without any guidance on data handling, retention, access controls, or compliance review. Because the skill is designed for bulk collection of profile metadata for outreach and competitive intelligence, it materially increases the chance of improper storage, secondary use, or accidental disclosure of personal data.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-list-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"listUrl": "https://twitter.com/i/lists/<LIST_ID>"}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-list-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"listUrl": "https://twitter.com/i/lists/<LIST_ID>"}'
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-list-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"listUrl": "https://twitter.com/i/lists/<LIST_ID>"}'
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-list-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"listUrl": "https://twitter.com/i/lists/<LIST_ID>"}'
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Intent-Code Divergence

Low
Confidence
96% confidence
Finding
The manifest and surrounding documentation consistently describe scraping members of a Twitter/X list and returning profile data for those members. At L033, the inputs table contradicts that intent by stating `maxItems` is the maximum number of tweets to return, which is inconsistent with the skill's stated behavior.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.