ClawHub
Back to skill

Security audit

tracking-twitter-thought-leaders

Security checks for vulnerabilities and agentic risk

Overview

The skill’s Twitter research purpose is coherent, but its REST fallback teaches users to put an Apify token in URL query parameters, which can expose that credential in logs or process listings.

Review before installing. Use this only when you are comfortable sending search topics, Twitter/X handles, IDs, and URLs to Apify/apidojo. Avoid the documented REST fallback as written; prefer an authorization header or an MCP/tool integration that does not place APIFY_TOKEN in the URL, and use a least-privilege Apify token.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:101
Finding

APIFY_TOKEN Exposed Through URL Query Parameters

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:101-105 and SKILL.md:128-131
Vulnerability Type: Credential exposure through URL query parameters
Risk Level: Medium

Vulnerable Code

bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "searchTerms": ["[TOPIC_KEYWORD_1]", "[TOPIC_KEYWORD_2]"],
    "maxItems": 300
  }'
bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["[username1]", "[username2]"]}'

Technical Analysis

The documented REST fallback expands the APIFY_TOKEN environment variable directly into each request URL. Although HTTPS encrypts the request in transit, it does not protect the token from exposure at endpoints and local observation surfaces where URLs may be recorded.

The expanded credential may appear in process command-line arguments, shell tracing output, debugging records, proxy logs, server access logs, monitoring systems, and URL telemetry. Query parameters are commonly retained in logs more broadly than authorization headers. This exceeds the minimum disclosure required for the Skill's functionality because Apify authentication can be supplied through an HTTP authorization header instead.

The outbound transfer of topic keywords and public Twitter/X handles to the declared Apify service is consistent with the Skill's stated functionality. The vulnerability is specifically the unsafe placement of the authentication secret in the URL.

Attack Path

  1. A user or agent follows one of the documented REST fallback commands.
  2. The shell expands $APIFY_TOKEN into the curl command-line URL.
  3. A local user with process-observation access, enabled shell tracing, a diagnostic collector, a proxy, or an HTTP logging component records ...[truncated 909 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the token=$APIFY_TOKEN query parameter from both URLs.

  • Supply the credential using an authorization header supported by Apify, for example:

    bash
    curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "searchTerms": ["[TOPIC_KEYWORD_1]", "[TOPIC_KEYWORD_2]"],
    "maxItems": 300
  }'
    bash
    curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["[username1]", "[username2]"]}'

  • Avoid shell tracing or verbose diagnostic output while handling credentials.

  • Configure clients, proxies, and monitoring systems to redact authorization data.

  • Use a least-privilege Apify token with only the permissions required to run the specified actors.

  • Rotate any token that may already have been captured in process records, traces, or URL logs.

  • Add automated documentation linting to reject credentials placed in URL query strings.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest says the skill triggers when a user asks to 'find the top voices,' 'identify thought leaders,' 'discover who has the most influence,' and similar phrasings across 'any industry.' These phrases are broad natural-language requests without explicit exclusions or tighter scope constraints, which could cause unintended invocation for general research or marketing-related queries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill sends user-supplied search topics, Twitter handles, and related identifiers to Apify-operated third-party actors without an upfront user warning. That creates a privacy and transparency risk because users may not realize their queries and target accounts are being transmitted to an external service, potentially including sensitive research interests or monitored persons.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This REST fallback explicitly transmits search terms to an external API endpoint, which can expose sensitive business research topics, investigations, or monitoring targets to a third party. In this skill's context, the transmission is core functionality, but it remains security-relevant because no consent gate, minimization, or sensitivity check is described before sending the data.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

REST API fallback:

bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

REST API fallback:

bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "searchTerms": ["[TOPIC_KEYWORD_1]", "[TOPIC_KEYWORD_2]"],

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This request sends usernames to a third-party scraping actor, which may reveal target lists, competitor research, journalist monitoring, or other sensitive relationship mapping to the external provider. The danger is increased by the skill's PR/outreach use case, where account lists may reflect confidential strategy, yet the skill does not warn users or require confirmation before disclosure.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

REST API fallback:

bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~twitter-user-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"usernames": ["[username1]", "[username2]"]}'

Static analysis

No suspicious patterns detected.