Twitter/X scraper with Apify actors

Use this skill when the user needs Twitter/X audience collection through Apify actors (followers/following/both) with optional email enrichment, username ext...

This skill appears coherent and does what it says: it uses your APIFY_TOKEN to call Apify and run follower/email actors, returning normalized rows. Before installing or running it: 1) Treat APIFY_TOKEN as sensitive—use a token scoped/minimized for this purpose or a throwaway/test token for initial tests; 2) Review the default actor IDs (bIYXeMcKISYGnHhBG and mSaHt2tt3Z7Fcwf0o) on Apify—those are third‑party actors and will run their code on Apify's platform when you invoke them; if you don't control those actors, inspect their source/behavior or replace them with actors you trust; 3) Test with small limits and with --include-emails disabled to verify behavior and cost; 4) Consider legal and privacy constraints (scraping/processing personal data and email enrichment may violate service terms or laws in some jurisdictions); 5) Note minor repo issues (duplicated frontmatter keys in SKILL.md and a small potential code bug around dt.UTC that could raise an exception) — these are not security red flags but you may want to run a quick smoke test locally. If you need to proceed but are unsure about the third‑party actors, ask the skill publisher for the actor source or use your own Apify actors instead.

Type: OpenClaw Skill Name: twitter-x-apify-actors Version: 1.0.3 The skill is designed to interact with the Apify API for Twitter/X data collection, which aligns with its stated purpose. However, the `scripts/apify_twitter_actors.py` allows the `follower-actor-id` and `email-actor-id` to be overridden via command-line arguments. While this offers flexibility, it introduces a vulnerability where an AI agent or a malicious user could instruct the skill to execute arbitrary Apify actors (not just the intended ones) if input validation is insufficient at the agent runtime level. This constitutes a risky capability without clear malicious intent within the skill itself, thus classifying it as suspicious rather than malicious.