X/Twitter by altf1be

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:08 PM UTC
• Version: 1.1.3

Overview

This skill does what it says, but it can publish live posts from the user's X/Twitter account without documented confirmation safeguards.

Install only if you are comfortable giving the skill credentials that can post from your X/Twitter account. Treat every tweet, reply, thread, and media command as a live public publish action, and require your agent to preview content and get explicit approval before posting.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Credential Access

High

• Category: Privilege Escalation

Content

npm install

# 3. Configure
cp .env.example .env
# Edit .env with your X API credentials

# 4. Use

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# 3. Configure
cp .env.example .env
# Edit .env with your X API credentials

# 4. Use
node scripts/xpost.mjs verify

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- Node.js 18+
- X/Twitter developer account with Free tier (or higher)
- API keys (Bearer Token, Consumer Key/Secret, Access Token/Secret)

## Commands

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Setup

1. Get API keys from https://developer.x.com
2. Set environment variables (or create `.env` in `{baseDir}`):

```

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

// ── Path validation (LFI protection) ────────────────────────────────────────

const BLOCKED_SEGMENTS = [
  '/.ssh/', '/.gnupg/', '/.env', '/.git/config', '/.netrc',
  '/etc/', '/proc/', '/sys/', '/dev/',
];

• Confidence: 80% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

// ── Path validation (LFI protection) ────────────────────────────────────────

const BLOCKED_SEGMENTS = [
  '/.ssh/', '/.gnupg/', '/.env', '/.git/config', '/.netrc',
  '/etc/', '/proc/', '/sys/', '/dev/',
];

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill description says it can post tweets, threads, and media, but it does not prominently warn that these actions publish directly to a real X/Twitter account. In an agent marketplace or skill catalog, missing this warning can mislead users about the real-world side effects and increase the chance of accidental public posting.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The README shows broad natural-language examples such as 'Tweet:' and 'Post this thread...' without clear confirmation or trigger constraints, which can cause an agent to treat ordinary conversational text as an instruction to publish to a live social-media account. In an agent-integrated context, this increases the risk of unintended or prompt-injected posting on behalf of the user.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill requests and uses sensitive environment variables and performs network actions, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This weakens transparency and policy enforcement because users and orchestrators cannot easily constrain or review the skill's operational capabilities before use.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation encourages tweet, reply, thread, and media posting without clearly warning that these actions are public, immediately attributable to the user's account, and may be hard to fully undo. In an agent context, missing disclosure increases the risk of accidental reputational harm, unintended publication of sensitive information, or irreversible automated posting.

External Transmission

Medium

• Category: Data Exfiltration

Content

// ── API helpers ─────────────────────────────────────────────────────────────

const API_BASE = 'https://api.x.com/2';
const UPLOAD_BASE = 'https://upload.twitter.com/1.1';

async function apiRequest(method, url, body = null) {

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"url": "https://github.com/ALT-F1-OpenClaw/openclaw-skill-x-twitter.git"
  },
  "dependencies": {
    "commander": "^12.0.0",
    "dotenv": "^16.0.0"
  },
  "engines": {

• Confidence: 40% confidence
• Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "dependencies": {
    "commander": "^12.0.0",
    "dotenv": "^16.0.0"
  },
  "engines": {
    "node": ">=18.0.0"

• Confidence: 40% confidence
• Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Static analysis

No suspicious patterns detected.