tracking-product-launch-buzz-on-twitter

• Outcome: Pass
• Latest audit: Sep 3, 2026 · 6:39 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Twitter/X launch-monitoring helper that uses Apify as expected, with privacy caveats around the queries sent to that service.

Install only if you are comfortable sending Twitter/X search terms, product names, competitor names, filters, and usage patterns to Apify. Do not include confidential launch plans, regulated data, or sensitive internal codenames in searches, and monitor Apify account usage because broad or unlimited queries may consume service quota.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill clearly instructs the agent to send user-provided search terms and related parameters to Apify's external Twitter-scraper service, but the skill description does not warn users that their queries will be transmitted to a third party. This creates a privacy and data-handling risk, especially when users may include confidential product names, launch plans, competitor monitoring targets, or location filters without realizing that information leaves the local environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"searchTerms": ["[PRODUCT] launch", "[PRODUCT] just launched", "new [PRODUCT]", "[PRODUCT] release"], "maxItems": 100}'

• Confidence: 95% confidence
• Finding: This command sends searchTerms and other user-supplied parameters to Apify over the network, which is an external data transmission path. While this is core to the skill's functionality rather than obviously malicious behavior, it is still security-relevant because users may unknowingly disclose sensitive business intelligence or other private inputs to a third-party service.

External Transmission

Medium

• Category: Data Exfiltration

Content

**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"searchTerms": ["[PRODUCT] launch", "[PRODUCT] just launched", "new [PRODUCT]", "[PRODUCT] release"], "maxItems": 100}'
```

• Confidence: 91% confidence
• Finding: The referenced Apify API endpoint confirms that the skill depends on an external service for processing and therefore transmits data outside the primary system boundary. In context, this is expected behavior for a scraper-backed skill, but it remains a real exposure because search content, targeting parameters, and usage patterns may reveal sensitive operational intent.

External Transmission

Medium

• Category: Data Exfiltration

Content

**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"searchTerms": ["[PRODUCT] launch", "[PRODUCT] just launched", "new [PRODUCT]", "[PRODUCT] release"], "maxItems": 100}'
```

• Confidence: 91% confidence
• Finding: The referenced Apify API endpoint confirms that the skill depends on an external service for processing and therefore transmits data outside the primary system boundary. In context, this is expected behavior for a scraper-backed skill, but it remains a real exposure because search content, targeting parameters, and usage patterns may reveal sensitive operational intent.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.