ClawHub
Back to skill

Security audit

Xint

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real X/Twitter research CLI, but it has broad long-lived account permissions and unsafe installation/server patterns that users should review before installing.

Install only after reviewing the installer or using a more controlled path such as Homebrew or manual source checkout. Use least-privilege X/xAI credentials, avoid authorizing tweet.write unless the app removes that scope, set XINT_INSTALL_REQUIRE_CHECKSUM=1 if using install.sh, and do not enable webhooks, SSE MCP, or the package API server outside a trusted local environment with explicit auth and host controls.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
README.md:34
Finding

Mutable Remote Installer Is Piped Directly into a Shell

Content
View full analysis
\ curl -fsSL https://raw.githubusercontent.com/0xNyk/xint/main/install.sh | bash ``` ### Technical Analysis The installation instructions stream a script from the repository's mutable `main` branch directly into Bash. The script is executed without first being saved, inspected, pinned to an immutable commit, or independently authenticated. Setting `XINT_INSTALL_VERSION` only controls which release archive the downloaded installer subsequently selects. It does not pin or authenticate the installer itself. Consequently, the effective code executed by this command may change at any time after the Skill has been reviewed. This creates a remote code-execution channel controlled by the GitHub repository and its account, branch, and release infrastructure. A compromise of the maintainer account, repository permissions, branch protections, or upstream delivery path could convert the documented installation command into arbitrary command execution. ### Attack Path 1. An attacker compromises the repository owner, a maintainer account, or another mechanism capable of modifying `main/install.sh`. 2. The attacker inserts credential theft, persistence, or other arbitrary commands into the installer. 3. A user follows the README and runs the documented `curl ... | bash` command. 4. Bash executes the streamed content immediately with the invoking user's privileges. 5. The payload can access the user's environment, files, API credentials, shell configuration, and any resources available to that account. The same path applies to the nominally pinned example ...[truncated 705 chars]
Remediation
View remediation
/install.sh ``` 4. Publish a SHA-256 digest or cryptographic signature through a separately protected release manifest. 5. Require verification before execution: ```bash sha256sum -c install.sh.sha256 less install.sh bash install.sh ``` 6. Prefer a trusted package manager with immutable versioning and package-signing support. 7. If a convenience bootstrap command is retained, pin it to an immutable commit hash and clearly disclose that direct remote execution remains risky. ]]>

T08 · Insecure Dependencies

Error
Location
install.sh:49
Finding

Installer Proceeds When Release Integrity Verification Is Unavailable

Content
View full analysis
/dev/null; then local asset_name asset_name="$(basename "$tarball_url")" local expected expected="$(awk -v name="$asset_name" '$0 ~ name {print $1; exit}' "$checksums_file" || true)" if [[ -n "$expected" ]]; then local actual="" if command -v sha256sum >/dev/null 2>&1; then actual="$(sha256sum "$tarball" | awk '{print $1}')" elif command -v shasum >/dev/null 2>&1; then actual="$(shasum -a 256 "$tarball" | awk '{print $1}')" fi if [[ -n "$actual" ]]; then if [[ "$actual" != "$expected" ]]; then echo "error: checksum mismatch for $asset_name" >&2 exit 1 fi echo "==> Checksum verified" else if [[ "${XINT_INSTALL_REQUIRE_CHECKSUM:-0}" == "1" ]]; then echo "error: checksum required but neither sha256sum nor shasum is available" >&2 exit 1 fi echo "==> Checksum tool unavailable; skipping verification" fi else if [[ "${XINT_INSTALL_REQUIRE_CHECKSUM:-0}" == "1" ]]; then echo "error: checksum required but no entry found in checksums.txt" >&2 exit 1 fi echo "==> Checksums file present but no entry for $asset_name; skipping verification" fi else if [[ "${XINT_INSTALL_REQUIRE_CHECKSUM:-0}" == "1" ]]; then echo "error: checksum required but checksums.txt not found in release" >&2 exit 1 fi echo "==> No checksums.txt in release; skipping checksum verification" fi ``` After these fail-open branches, the installer extracts the source and installs its dependencies: ```bash tar -xzf "$tarball" -C "$tmpdir" ... cp -R "${src_dir}/." "$re ...[truncated 2036 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
lib/collections.ts:178
Finding

xAI Bearer Credentials Are Exposed Through Child-Process Arguments

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
lib/oauth.ts:23
Finding

OAuth Flow Requests Write Permissions Beyond the Declared Functional Requirements

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (192)

Tainted flow: 'req' from os.environ.get (line 183, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/xai_collections.py (reported line 110)May include surrounding context.

python
req = urllib.request.Request(url, data=data, method=method.upper(), headers=headers)
    try:
        with urllib.request.urlopen(req, timeout=timeout_s) as resp:
            txt = resp.read().decode("utf-8", errors="replace")
            return (json.loads(txt) if txt else {}), plan
    except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 183, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/xai_collections.py (reported line 185)May include surrounding context.

python
req = urllib.request.Request(url, data=data, method=method.upper(), headers=headers)
    try:
        with urllib.request.urlopen(req, timeout=timeout_s) as resp:
            txt = resp.read().decode("utf-8", errors="replace")
            return (json.loads(txt) if txt else {}), plan
    except urllib.error.HTTPError as e:

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The | bash construct is the risky element that turns a remote fetch into immediate shell execution, enabling command-chaining abuse and eliminating any review step. In this skill’s context, such a pattern is especially unsafe because it normalizes high-trust execution for a tool that also handles API tokens, OAuth credentials, and network operations.

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

Install

bash
curl -fsSL https://raw.githubusercontent.com/0xNyk/xint/main/install.sh | bash

Optional pinned version:

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The version-pinned install still uses command chaining to execute fetched content immediately, so the security issue remains. If the remote content or distribution path is compromised, users can be induced to run attacker-controlled code with no inspection barrier.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

bash
XINT_INSTALL_VERSION=<version-tag> \
curl -fsSL https://raw.githubusercontent.com/0xNyk/xint/main/install.sh | bash

Homebrew (lightweight prebuilt binary on Apple Silicon):

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Repository ruleset and branch-protection changes are privileged GitHub write actions far outside the stated X intelligence use case. Such hidden admin capabilities materially increase the blast radius of misuse, including disruption of development workflows and governance settings.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

Repository ruleset and branch-protection changes are privileged GitHub write actions far outside the stated X intelligence use case. Such hidden admin capabilities materially increase the blast radius of misuse, including disruption of development workflows and governance settings.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Repository ruleset and branch-protection changes are privileged GitHub write actions far outside the stated X intelligence use case. Such hidden admin capabilities materially increase the blast radius of misuse, including disruption of development workflows and governance settings.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Repository ruleset and branch-protection changes are privileged GitHub write actions far outside the stated X intelligence use case. Such hidden admin capabilities materially increase the blast radius of misuse, including disruption of development workflows and governance settings.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Repository ruleset and branch-protection changes are privileged GitHub write actions far outside the stated X intelligence use case. Such hidden admin capabilities materially increase the blast radius of misuse, including disruption of development workflows and governance settings.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

Repository ruleset and branch-protection changes are privileged GitHub write actions far outside the stated X intelligence use case. Such hidden admin capabilities materially increase the blast radius of misuse, including disruption of development workflows and governance settings.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

Repository ruleset and branch-protection changes are privileged GitHub write actions far outside the stated X intelligence use case. Such hidden admin capabilities materially increase the blast radius of misuse, including disruption of development workflows and governance settings.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Repository ruleset and branch-protection changes are privileged GitHub write actions far outside the stated X intelligence use case. Such hidden admin capabilities materially increase the blast radius of misuse, including disruption of development workflows and governance settings.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

Repository ruleset and branch-protection changes are privileged GitHub write actions far outside the stated X intelligence use case. Such hidden admin capabilities materially increase the blast radius of misuse, including disruption of development workflows and governance settings.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Repository ruleset and branch-protection changes are privileged GitHub write actions far outside the stated X intelligence use case. Such hidden admin capabilities materially increase the blast radius of misuse, including disruption of development workflows and governance settings.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Repository ruleset and branch-protection changes are privileged GitHub write actions far outside the stated X intelligence use case. Such hidden admin capabilities materially increase the blast radius of misuse, including disruption of development workflows and governance settings.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Repository ruleset and branch-protection changes are privileged GitHub write actions far outside the stated X intelligence use case. Such hidden admin capabilities materially increase the blast radius of misuse, including disruption of development workflows and governance settings.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Repository ruleset and branch-protection changes are privileged GitHub write actions far outside the stated X intelligence use case. Such hidden admin capabilities materially increase the blast radius of misuse, including disruption of development workflows and governance settings.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Repository ruleset and branch-protection changes are privileged GitHub write actions far outside the stated X intelligence use case. Such hidden admin capabilities materially increase the blast radius of misuse, including disruption of development workflows and governance settings.

Content

No source excerpt is available for this finding.

Scope Creep

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly supports posting data to arbitrary HTTPS webhook destinations, which is a strong exfiltration vector when combined with search results, OAuth-derived data, or local exports. Even with optional allowlisting, the default design permits sending collected data outside the declared endpoint set.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md
- Webhook delivery is opt-in (`--webhook`) and disabled by default

### Installation
- For Bun: prefer OS package managers over `curl | bash` when possible
- Verify any installer scripts before running

### MCP Server (Optional)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 284)May include surrounding context.

md
python3 scripts/xai_x_search_scan.py --help

Scope Creep

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documented external services exceed the declared network endpoints in the security manifest, which means actual outbound connections may occur to destinations the operator is not told to expect. In a credentialed skill with file and network access, undeclared endpoints are dangerous because they obscure data flows and hamper policy enforcement.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 294)May include surrounding context.

md
python3 scripts/xai_collections.py --help

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · install.sh (reported line 26)May include surrounding context.

sh
local api_url="https://api.github.com/repos/${OWNER}/${REPO}/releases/latest"
  local tag
  tag="$(curl -fsSL "$api_url" | python3 -c 'import json,sys; print(json.load(sys.stdin)["tag_name"])')"
  printf '%s' "$tag"
}

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/api.ts (reported line 16)May include surrounding context.

ts
// Try env first
  if (process.env.X_BEARER_TOKEN) return process.env.X_BEARER_TOKEN;

  // Try .env in project directory
  try {
    const envFile = readFileSync(
      join(import.meta.dir, "..", ".env"),

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal, suspicious.potential_exfiltration

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
lib/api.ts:14

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
lib/article.ts:52

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
lib/billing.ts:9

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
lib/collections.ts:68

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
lib/grok.ts:78

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
lib/health.ts:107

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
lib/mcp.ts:38

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
lib/oauth.ts:92

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
lib/trends.ts:144

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
lib/x_search.ts:70

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
xint.ts:1285

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
lib/oauth.ts:186

Sensitive-looking file read is paired with a network send.

Warn
Code
suspicious.potential_exfiltration
Location
lib/api.ts:1

Sensitive-looking file read is paired with a network send.

Warn
Code
suspicious.potential_exfiltration
Location
lib/article.ts:55

Sensitive-looking file read is paired with a network send.

Warn
Code
suspicious.potential_exfiltration
Location
lib/grok.ts:82

Sensitive-looking file read is paired with a network send.

Warn
Code
suspicious.potential_exfiltration
Location
lib/oauth.ts:74

Sensitive-looking file read is paired with a network send.

Warn
Code
suspicious.potential_exfiltration
Location
lib/trends.ts:1

Sensitive-looking file read is paired with a network send.

Warn
Code
suspicious.potential_exfiltration
Location
lib/x_search.ts:73