finding-freelancers-by-skill-on-twitter
Warn
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The
customMapFunctioninput parameter accepts a string described as a "JavaScript function to transform each output object." If evaluated at runtime, this allows for dynamic code execution based on input strings. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Twitter (bios and tweets) to identify and score candidates.
- Ingestion points: Twitter profiles and tweet content (SKILL.md).
- Boundary markers: No explicit markers are defined to isolate untrusted Twitter content from agent instructions.
- Capability inventory: Subprocess execution of Node.js scripts (
scripts/run_actor.js) and network operations viacurlto the Apify API. - Sanitization: No sanitization or filtering logic is provided for the retrieved social media content before it is scored or displayed.
- [COMMAND_EXECUTION]: The skill directs the agent to execute shell commands, including
node scripts/run_actor.jsandcurlfor interacting with the Apify REST API. These operations are core to the skill's data collection functionality.
Audit Metadata