ClawHub
Back to skill

Security audit

scraping-twitter-profile-tweets

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Apify-based Twitter/X profile scraping helper with disclosed external-service use and no bundled executable code.

Install only if you are comfortable sending target handles, profile URLs, date filters, and collection limits to Apify. Avoid using it for confidential target lists unless your Apify account and retention requirements are acceptable.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Content
### REST API fallback

```bash
curl -X POST "https://api.apify.com/v2/acts/apidojo~twitter-profile-scraper/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"twitterHandles": ["elonmusk"], "maxItems": 100}'
Confidence
83% confidence
Finding
The hardcoded Apify API endpoint confirms that the skill depends on a third-party network service, creating a trust and data exposure boundary. Although this is aligned with the skill's purpose, it remains security-relevant because requests containing handles, URLs, and filters are disclosed externally and may expose investigative interests or usage patterns.

External Transmission

Medium
Category
Data Exfiltration
Content
### REST API fallback

```bash
curl -X POST "https://api.apify.com/v2/acts/apidojo~twitter-profile-scraper/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"twitterHandles": ["elonmusk"], "maxItems": 100}'
Confidence
83% confidence
Finding
The hardcoded Apify API endpoint confirms that the skill depends on a third-party network service, creating a trust and data exposure boundary. Although this is aligned with the skill's purpose, it remains security-relevant because requests containing handles, URLs, and filters are disclosed externally and may expose investigative interests or usage patterns.

Missing User Warnings

Low
Confidence
92% confidence
Finding
The skill explicitly instructs users to send Twitter handles, profile URLs, date filters, and other query parameters to Apify, but it does not clearly warn that these inputs are transmitted to a third-party external service. While the data involved is generally low sensitivity, lack of disclosure can cause unintended sharing of user-supplied targets, search scope, or operational intent with an external provider.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.