Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches its stated Twitter/X scraping purpose, but it needs review because it can spend paid Apify credits without an enforced cap and can forward unintended URLs to Apify.
Review before installing. Use an Apify account with spending limits, keep --max-results conservative, pass only x.com/twitter.com tweet URLs without secrets in query strings, avoid storing tokens in committed .env files or synced dotfiles, and use --no-cache or a private cache directory for sensitive searches.
scripts/config.py:118Unvalidated Tweet URL Is Disclosed to a Third-Party Apify Actor
scripts/fetch_tweets.py:348Unbounded Result Count Can Trigger Excessive Paid Actor Usage
scripts/fetch_tweets.py:419Output Path Confinement Can Be Bypassed by Prefix Collisions and Symlinks
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
export APIFY_API_TOKEN="apify_api_YOUR_TOKEN_HERE" export APIFY_ACTOR_ID="apidojo~tweet-scraper"
echo 'APIFY_API_TOKEN=apify_api_YOUR_TOKEN_HERE' >> .env
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
export APIFY_API_TOKEN="apify_api_YOUR_TOKEN_HERE" export APIFY_ACTOR_ID="apidojo~tweet-scraper"
echo 'APIFY_API_TOKEN=apify_api_YOUR_TOKEN_HERE' >> .env
L54 states 'Get a specific tweet + replies by URL' as a supported capability. However, L10 explicitly documents actor limits including 'no single-tweet or reply scraping,' which directly contradicts that earlier documented intent rather than merely omitting detail.
The skill declares environment, file read/write, and network-capable behavior but does not define an explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, this can cause overbroad execution authority and makes it harder for operators to review or constrain what the skill is permitted to access.
The manifest advertises retrieval of a specific tweet with replies, while the documentation later states the default actor does not support single-tweet fetches or conversation scraping. This mismatch can mislead users or calling agents into invoking unsupported behavior, potentially causing repeated failed runs, incorrect trust in output completeness, or avoidable spend.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## Setup
1. Create a free Apify account: https://apify.com/
2. Get your API token: https://console.apify.com/account/integrations
3. Set environment variables:
Advising users to place API tokens in ~/.bashrc or ~/.zshrc creates long-lived credential persistence in plaintext shell startup files. This increases exposure to local compromise, accidental disclosure through backups/dotfile sync, or token reuse across sessions beyond what is necessary.
# Add to ~/.bashrc or ~/.zshrc
export APIFY_API_TOKEN="apify_api_YOUR_TOKEN_HERE"
export APIFY_ACTOR_ID="apidojo~tweet-scraper"
The instructions explicitly tell users to append an API token into a local .env file without sufficient warning about local credential storage risks. If that file is left with weak permissions, copied into backups, or accidentally exposed, the Apify token could be reused for unauthorized API access and billing abuse.
The skill stores fetched tweet data on disk by default but does not clearly warn users that data will persist locally. On shared systems or sensitive workflows, this can expose search history, target handles, and scraped content to other local users, backups, or later unintended reuse.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
from pathlib import Path
# API configuration
APIFY_API_BASE = "https://api.apify.com/v2"
# apidojo~tweet-scraper (Tweet Scraper V2). Checked on the Apify API 2026-08-31:
# public, not deprecated, $0.40 per 1,000 tweets, 0 failed of 4.7M public runs in 30 days.
# The payloads in fetch_tweets.py (searchTerms / startUrls / maxItems) are this actor's
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
try:
# Start the run
response = requests.post(
run_url,
headers=headers,
json=input_data,
The manifest and top-level description advertise 'get user profiles,' but this section documents --user with examples that 'Get tweets from a specific user' and earlier maps user timeline input to startUrls. That is a direct documentation-to-behavior mismatch because the feature described here is timeline scraping, not profile retrieval.
Detected: suspicious.exposed_secret_literal