ClawHub
Back to skill

Security audit

Tweet Cli

Security checks for vulnerabilities and agentic risk

Overview

This skill is not overtly malicious, but it needs Review because it installs a global third-party CLI that uses persistent X API credentials and includes an under-disclosed delete command.

Install only if you trust the tweet-cli upstream and are comfortable giving it X account write access. Prefer auditing the resolved source, pinning to an immutable commit, using narrowly scoped and revocable X credentials, and confirming manually before any post, reply, quote, or delete action.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:17
Finding
Third-Party CLI Installed from a Mutable Git Tag<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 17-19; the same command also appears in metadata on line 6 **Vulnerability Type**: Supply-chain risk from a mutable external dependency reference **Risk Level**: Medium ### Vulnerable Code ```bash # SKILL.md:17-19 ```bash npm install -g github:0xmythril/tweet-cli#v1.0.0 ``` ``` ### Technical Analysis The Skill directs users to install a globally available executable directly from a third-party GitHub repository. Although the reference resembles a fixed version, `v1.0.0` is a Git tag rather than an immutable commit hash. A repository administrator or an attacker who compromises the upstream repository may move or recreate that tag so that it resolves to different code after this Skill has been reviewed. The executable's implementation is not included in the audited project. Consequently, the claims that it has no installation scripts, no telemetry, and only the documented dependencies cannot be independently verified from the available artifact. Global installation increases exposure by placing the executable in a shared command search path for the current environment. The CLI is also expected to receive X API credentials, making upstream integrity particularly important. ### Attack Path 1. An attacker compromises the upstream `0xmythril/tweet-cli` repository or an authorized maintainer account. 2. The attacker moves or recreates the `v1.0.0` tag so it references malicious code. 3. A user follows the Skill instructions and executes the global npm installation command. 4. npm retrieves content currently referenced by the mutable tag. 5. Malicious package lifecycle code, if introduced, may execute during installation. Otherwise, the malicious CLI executes when the user invokes `tweet-cli`. 6. The altered CLI can access the user's X API credentials and act with the permissions granted to those credentials. ### Impact Assessment Successful exploitation can execute code with the privileg ...[truncated 482 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Replace the mutable Git tag with an audited, immutable full commit hash. 2. Prefer a verified registry artifact with lockfile or integrity-hash validation where possible. 3. Record the expected commit and package integrity value in the Skill documentation. 4. Inspect the resolved `package.json`, lifecycle scripts, bundled files, and dependency tree before installation. 5. Avoid global installation where practical. Use a project-local installation or an isolated execution environment with a restricted command path. 6. Verify the upstream source and release signatures before running the CLI. 7. Restrict the X application's authorization scope to only the operations required for posting. 8. Rotate all X API credentials immediately if an unverified or compromised build has been executed. ]]>

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:23
Finding
Credential File Creation Follows Pre-Existing Symbolic Links<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 23-31 **Vulnerability Type**: Unsafe credential-file creation and symbolic-link handling **Risk Level**: Low ### Vulnerable Code ```bash mkdir -p ~/.config/tweet-cli touch ~/.config/tweet-cli/.env chmod 600 ~/.config/tweet-cli/.env cat > ~/.config/tweet-cli/.env << 'EOF' X_API_KEY=your_consumer_key X_API_SECRET=your_secret_key X_ACCESS_TOKEN=your_access_token X_ACCESS_TOKEN_SECRET=your_access_token_secret EOF ``` ### Technical Analysis Storing API credentials is necessary for the Skill's declared Twitter/X posting functionality, and applying mode `600` is an appropriate least-privilege measure for a regular credential file. The behavior therefore does not inherently exceed the Skill's required privileges. However, `touch`, `chmod`, and shell output redirection follow a pre-existing symbolic link at `~/.config/tweet-cli/.env`. The instructions do not verify that the configuration directory and destination are owned by the current user, are not symbolic links, and have suitably restrictive permissions. If an attacker can prepare that path before setup runs, the credentials may be written to an unintended user-writable target. The commands could also truncate or change the permissions of another file accessible to the victim account. This is primarily relevant to already-compromised accounts, shared home directories, or environments with unsafe ownership or permission settings. ### Attack Path 1. A local attacker obtains sufficient access to create or replace `~/.config/tweet-cli/.env`, or takes advantage of an insecurely owned configuration directory. 2. The attacker creates `.env` as a symbolic link to another file writable by the victim. 3. The victim follows the documented setup instructions. 4. `touch` and `chmod` operate on the symbolic-link target. 5. Shell redirection follows the symbolic link, truncates the target, and writes the X API credentials into it. 6. If the selected ta ...[truncated 739 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Create and validate the configuration directory with owner-only permissions: ```bash install -d -m 700 "$HOME/.config/tweet-cli" ``` 2. Reject an existing symbolic link before writing: ```bash config="$HOME/.config/tweet-cli/.env" if [ -L "$config" ]; then echo "Refusing to overwrite a symbolic link: $config" >&2 exit 1 fi ``` 3. Set a restrictive process umask before creating credential-bearing files: ```bash umask 077 ``` 4. Write credentials to a securely created temporary file in the same directory, set its mode to `600`, and atomically rename it after validating the destination. 5. Verify that the configuration directory and existing destination, if any, are owned by the current user and are not links. 6. Prefer prompting users to enter real secrets interactively or directing them to edit the protected file, rather than encouraging credentials to be placed in shell history. 7. Rotate the X API credentials if there is any indication that setup wrote them to an unintended location. ]]>

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Credential Access

High
Category
Privilege Escalation
Content
```bash
npm install -g github:0xmythril/tweet-cli#v1.0.0
```
2. Get API keys from https://developer.x.com/en/portal/dashboard (Free tier works)
3. Configure credentials (file is created with restricted permissions):
```bash
mkdir -p ~/.config/tweet-cli
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
3. Configure credentials (file is created with restricted permissions):
```bash
mkdir -p ~/.config/tweet-cli
touch ~/.config/tweet-cli/.env
chmod 600 ~/.config/tweet-cli/.env
cat > ~/.config/tweet-cli/.env << 'EOF'
X_API_KEY=your_consumer_key
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
3. Configure credentials (file is created with restricted permissions):
```bash
mkdir -p ~/.config/tweet-cli
touch ~/.config/tweet-cli/.env
chmod 600 ~/.config/tweet-cli/.env
cat > ~/.config/tweet-cli/.env << 'EOF'
X_API_KEY=your_consumer_key
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
3. Configure credentials (file is created with restricted permissions):
```bash
mkdir -p ~/.config/tweet-cli
touch ~/.config/tweet-cli/.env
chmod 600 ~/.config/tweet-cli/.env
cat > ~/.config/tweet-cli/.env << 'EOF'
X_API_KEY=your_consumer_key
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The skill manifest and description say the tool is for posting tweets, replies, and quotes, but the documented command set also includes tweet deletion. This capability mismatch can mislead an agent or user about the tool’s real authority, increasing the chance of unintended destructive actions such as deleting content when the skill is assumed to be non-destructive.

Session Persistence

Medium
Category
Rogue Agent
Content
2. Get API keys from https://developer.x.com/en/portal/dashboard (Free tier works)
3. Configure credentials (file is created with restricted permissions):
```bash
mkdir -p ~/.config/tweet-cli
touch ~/.config/tweet-cli/.env
chmod 600 ~/.config/tweet-cli/.env
cat > ~/.config/tweet-cli/.env << 'EOF'
Confidence
76% confidence
Finding
The skill explicitly instructs persistent storage of long-lived API credentials in `~/.config/tweet-cli/.env`, enabling continued authenticated access across sessions. Even with `chmod 600`, plaintext secret persistence increases the blast radius of local compromise, accidental backup leakage, or other processes running as the same user accessing the file.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
mkdir -p ~/.config/tweet-cli
touch ~/.config/tweet-cli/.env
chmod 600 ~/.config/tweet-cli/.env
cat > ~/.config/tweet-cli/.env << 'EOF'
X_API_KEY=your_consumer_key
X_API_SECRET=your_secret_key
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
## Security

- **Credentials**: Stored in `~/.config/tweet-cli/.env` (read by `dotenv` at runtime). Set `chmod 600` to restrict access.
- **No postinstall scripts**: The package has zero install scripts — verify via `npm pack --dry-run` or inspect `package.json`.
- **No telemetry or network calls** except to the official X API (`api.x.com`) when you run a command.
- **Pinned install**: The install command pins to a specific release tag. Audit the source at https://github.com/0xmythril/tweet-cli before installing.
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.