ClawHub
Back to skill

Security audit

tracking-startup-founders-on-twitter

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Twitter founder-research workflow using Apify, with one credential-handling hygiene issue users should watch for.

Install only if you are comfortable using Apify to query Twitter/X data. Store APIFY_TOKEN in an environment variable or secret manager, avoid pasting token-bearing URLs into logs or shared terminals, prefer MCP or a helper that does not expose tokens in URLs, and set maxItems deliberately to control cost and data volume.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"searchTerms": ["founder [SECTOR]", "building [SECTOR] startup", "CEO [SECTOR]", "#buildinpublic [SECTOR]"], "maxItems": 100}'
Confidence
96% confidence
Finding
This example sends the APIFY_TOKEN in the request URL as a query parameter to an external service. Tokens placed in URLs are commonly captured in browser history, terminal history, monitoring systems, reverse proxies, and server access logs, making credential leakage more likely than header-based authentication.

External Transmission

Medium
Category
Data Exfiltration
Content
Wait for `SUCCEEDED`. Fetch dataset:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"
```

### Step 3: Classify Results
Confidence
95% confidence
Finding
This dataset retrieval example again includes APIFY_TOKEN in the URL query string for an external request. Even though HTTPS protects transport, URL-based secrets can still leak through logs, analytics, copied commands, process inspection, and operational tooling.

External Transmission

Medium
Category
Data Exfiltration
Content
Wait for `SUCCEEDED`. Fetch dataset:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"
```

### Step 3: Classify Results
Confidence
95% confidence
Finding
This dataset retrieval example again includes APIFY_TOKEN in the URL query string for an external request. Even though HTTPS protects transport, URL-based secrets can still leak through logs, analytics, copied commands, process inspection, and operational tooling.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The skill requires use of an APIFY_TOKEN but does not provide any guidance on secure handling of that credential. In context, the document later demonstrates passing the token in URL query strings, which increases the chance the secret is exposed via shell history, logs, screenshots, or proxy/server logs.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.