ClawHub
Back to skill

Security audit

Tweet Cli

Security checks for vulnerabilities and agentic risk

Overview

This skill is not overtly malicious, but it needs Review because it installs a global third-party CLI that uses persistent X API credentials and includes an under-disclosed delete command.

Install only if you trust the tweet-cli upstream and are comfortable giving it X account write access. Prefer auditing the resolved source, pinning to an immutable commit, using narrowly scoped and revocable X credentials, and confirming manually before any post, reply, quote, or delete action.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:17
Finding

Third-Party CLI Installed from a Mutable Git Tag

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:23
Finding

Credential File Creation Follows Pre-Existing Symbolic Links

Content
View full analysis
~/.config/tweet-cli/.env << 'EOF' X_API_KEY=your_consumer_key X_API_SECRET=your_secret_key X_ACCESS_TOKEN=your_access_token X_ACCESS_TOKEN_SECRET=your_access_token_secret EOF ``` ### Technical Analysis Storing API credentials is necessary for the Skill's declared Twitter/X posting functionality, and applying mode `600` is an appropriate least-privilege measure for a regular credential file. The behavior therefore does not inherently exceed the Skill's required privileges. However, `touch`, `chmod`, and shell output redirection follow a pre-existing symbolic link at `~/.config/tweet-cli/.env`. The instructions do not verify that the configuration directory and destination are owned by the current user, are not symbolic links, and have suitably restrictive permissions. If an attacker can prepare that path before setup runs, the credentials may be written to an unintended user-writable target. The commands could also truncate or change the permissions of another file accessible to the victim account. This is primarily relevant to already-compromised accounts, shared home directories, or environments with unsafe ownership or permission settings. ### Attack Path 1. A local attacker obtains sufficient access to create or replace `~/.config/tweet-cli/.env`, or takes advantage of an insecurely owned configuration directory. 2. The attacker creates `.env` as a symbolic link to another file writable by the victim. 3. The victim follows the documented setup instructions. 4. `touch` and `chmod` operate on the symbolic-link target. 5. Shell redirection follows the symbolic link, truncates the target, and writes the X API credentials into it. 6. If the selected ta ...[truncated 739 chars]
Remediation
View remediation
&2 exit 1 fi ``` 3. Set a restrictive process umask before creating credential-bearing files: ```bash umask 077 ``` 4. Write credentials to a securely created temporary file in the same directory, set its mode to `600`, and atomically rename it after validating the destination. 5. Verify that the configuration directory and existing destination, if any, are owned by the current user and are not links. 6. Prefer prompting users to enter real secrets interactively or directing them to edit the protected file, rather than encouraging credentials to be placed in shell history. 7. Rotate the X API credentials if there is any indication that setup wrote them to an unintended location. ]]>

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

bash
npm install -g github:0xmythril/tweet-cli#v1.0.0
  1. Get API keys from https://developer.x.com/en/portal/dashboard (Free tier works)
  2. Configure credentials (file is created with restricted permissions):
bash
mkdir -p ~/.config/tweet-cli

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

  1. Configure credentials (file is created with restricted permissions):
bash
mkdir -p ~/.config/tweet-cli
touch ~/.config/tweet-cli/.env
chmod 600 ~/.config/tweet-cli/.env
cat > ~/.config/tweet-cli/.env << 'EOF'
X_API_KEY=your_consumer_key

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

  1. Configure credentials (file is created with restricted permissions):
bash
mkdir -p ~/.config/tweet-cli
touch ~/.config/tweet-cli/.env
chmod 600 ~/.config/tweet-cli/.env
cat > ~/.config/tweet-cli/.env << 'EOF'
X_API_KEY=your_consumer_key

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

  1. Configure credentials (file is created with restricted permissions):
bash
mkdir -p ~/.config/tweet-cli
touch ~/.config/tweet-cli/.env
chmod 600 ~/.config/tweet-cli/.env
cat > ~/.config/tweet-cli/.env << 'EOF'
X_API_KEY=your_consumer_key

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill manifest and description say the tool is for posting tweets, replies, and quotes, but the documented command set also includes tweet deletion. This capability mismatch can mislead an agent or user about the tool’s real authority, increasing the chance of unintended destructive actions such as deleting content when the skill is assumed to be non-destructive.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
76% confidence
Finding

The skill explicitly instructs persistent storage of long-lived API credentials in ~/.config/tweet-cli/.env, enabling continued authenticated access across sessions. Even with chmod 600, plaintext secret persistence increases the blast radius of local compromise, accidental backup leakage, or other processes running as the same user accessing the file.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

  1. Get API keys from https://developer.x.com/en/portal/dashboard (Free tier works)
  2. Configure credentials (file is created with restricted permissions):
bash
mkdir -p ~/.config/tweet-cli
touch ~/.config/tweet-cli/.env
chmod 600 ~/.config/tweet-cli/.env
cat > ~/.config/tweet-cli/.env << 'EOF'

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

bash
mkdir -p ~/.config/tweet-cli
touch ~/.config/tweet-cli/.env
chmod 600 ~/.config/tweet-cli/.env
cat > ~/.config/tweet-cli/.env << 'EOF'
X_API_KEY=your_consumer_key
X_API_SECRET=your_secret_key

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
## Security

- **Credentials**: Stored in `~/.config/tweet-cli/.env` (read by `dotenv` at runtime). Set `chmod 600` to restrict access.
- **No postinstall scripts**: The package has zero install scripts — verify via `npm pack --dry-run` or inspect `package.json`.
- **No telemetry or network calls** except to the official X API (`api.x.com`) when you run a command.
- **Pinned install**: The install command pins to a specific release tag. Audit the source at https://github.com/0xmythril/tweet-cli before installing.

Static analysis

No suspicious patterns detected.