Openclaw Twitter Post Engage

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:52 AM UTC
• Version: 1.0.3

Overview

The skill is a disclosed Twitter/X relay integration, but its write clients can post, upload media, like, follow, and print an API key without enforcing the promised final approval in code.

Install only if you are comfortable giving the AISA relay and this skill authority over the connected Twitter/X account. Rotate any AISA key that may have appeared in logs, avoid running write commands unless you personally review the exact target and payload, and prefer a version that removes API-key output and enforces approval tokens for every post, media upload, like, follow, unlike, and unfollow.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/twitter_oauth_client.py:458

Finding

AISA API Key Exposed in JSON Command Output

Content

View full analysis

None: config = load_config(args) payload = {"aisa_api_key": config["aisa_api_key"]} result = send_json_request( f"{config['base_url']}/auth_twitter", payload, timeout=config["timeout"], aisa_api_key=config["aisa_api_key"], ) if result.get("ok") is False: print(json.dumps(result, indent=2, ensure_ascii=False)) sys.exit(1) auth_url = (result.get("data") or {}).get("auth_url") output = { "ok": result.get("code") == 200 and bool(auth_url), "aisa_api_key": config["aisa_api_key"], "authorization_url": auth_url, "raw_response": result, } print(json.dumps(output, indent=2, ensure_ascii=False)) ``` ### Technical Analysis `AISA_API_KEY` is a bearer credential us ...[truncated 2339 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/twitter_oauth_client.py:486

Finding

Posting and Media Upload Bypass the Declared Final Confirmation Requirement

Content

View full analysis

None: """Split oversized content locally, then publish chunks through the relay.""" config = load_config(args) media_ids = getattr(args, "media_id", None) or [] media_files = load_media_files(getattr(args, "media_file", None)) normalized_text = (args.text or "").strip() quote_tweet_url = (getattr(args, "quote_tweet_url", None) or "").strip() initial_parent_tweet_id = None if not normalized_text and not media_ids and not media_files: print( json.dumps( {"ok": False, "error": "Post content must not be empty unless media files or media IDs are provided."}, indent=2, ensure_ascii=False, ) ) sys.exit(1) if args.type == "quote": if args.in_reply_to_tweet_id: raise RelayConfigError( "Quote posts that reference another tweet must use --quote-tweet-url. " "The published post will include that link in its content." ) if quote_tweet_url: initial_parent_tweet_id = extract_tweet_id_from_url(quote_tweet_url) normalized_text = append_quote_url_to_content(normalized_text, quote_tweet_url) else: if quote_tweet_url: raise RelayConfigError("--quote-tweet-url can only be used together with --type quote.") initial_parent_tweet_id = args.in_reply_to_tweet_id chunks = split_text_for_twitter(normalized_text) if normalized_text else [""] should_use_post_type = len(chunks) > 1 or bool(initial_parent_tweet_id) effective_post_type = None ...[truncated 3289 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/twitter_engagement_client.py:338

Finding

Like, Unlike, Follow, and Unfollow Actions Execute Without Final Confirmation

Content

View full analysis

None: config = load_config(args) payload = { "aisa_api_key": config["aisa_api_key"], "tweet_id": tweet_id.strip(), } relay_result = relay_action(config, endpoint, payload) ok = relay_result.get("ok") is not False and is_success_response(relay_result) response = { "ok": ok, "action": action, "target": build_target("tweet", tweet_id, username=username, label=label), "message": format_action_message( action if ok else f"{action}_failed", username=username, label=label, msg=relay_result.get("msg"), ), "raw_response": relay_result, } if resolved_tweet: response["resolved_tweet"] = resolved_tweet print_json(response, exit_code=0 if ok else 1) def execute_user_action( args: argparse.Namespace, *, endpoint: str, action: str, target_user_id: str, username: Optional[str] = None, resolved_user: Optional[Dict[str, Any]] = None, ) -> None: config = load_config(args) payload = { "aisa_api_key": config["aisa_api_key"], "target_user_id": target_user_id.strip(), } relay_result = relay_action(config, endpoint, payload) ok = relay_result.get("ok") is not False and is_success_response(relay_result) response = { "ok": ok, "action": action, "target": build_target("user", username or target_user_id, user_id=target_user ...[truncated 2788 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Even if the exact unsupported feature set differs, the common issue is that the skill advertises stronger safeguards and broader behavior than the implementation delivers. False assurances about confirmation requirements are particularly risky for social-media write operations because they can lead to unauthorized posting, follows, or other externally visible actions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Even if the exact unsupported feature set differs, the common issue is that the skill advertises stronger safeguards and broader behavior than the implementation delivers. False assurances about confirmation requirements are particularly risky for social-media write operations because they can lead to unauthorized posting, follows, or other externally visible actions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Even if the exact unsupported feature set differs, the common issue is that the skill advertises stronger safeguards and broader behavior than the implementation delivers. False assurances about confirmation requirements are particularly risky for social-media write operations because they can lead to unauthorized posting, follows, or other externally visible actions.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md

- The release bundle is runtime-only: it keeps `SKILL.md`, `scripts/`, and the required references, while omitting non-runtime files such as `README.md` and `_m

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The client includes the full AISA API key in JSON output returned to the user during posting flows, which can leak credentials into terminals, logs, transcripts, shell history captures, or upstream agent outputs. In this skill context, outputs are likely relayed through automation systems and approval workflows, making accidental credential disclosure substantially more dangerous than a normal local CLI tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The authorize command prints the AISA API key alongside the authorization URL and raw response, exposing a live credential during a sensitive OAuth-related workflow. Because this skill is intended for agent-mediated Twitter actions, printed output may be persisted in chat transcripts, CI logs, approval artifacts, or observability systems, enabling unauthorized reuse of the relay credential.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares runtime requirements for environment variables and makes network calls, but it does not declare a corresponding tool scope such as permissions or allowed-tools. This weakens sandboxing and reviewability because a host may allow broader execution than the manifest communicates, increasing the chance of unintended secret access or outbound requests.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/engage_twitter.md (reported line 27)May include surrounding context.

md

When the user asks to like, unlike, follow, or unfollow on X/Twitter:

1. Do not ask the user to manually paste tweet links or IDs.
2. If the user first asked to query tweets, keep the returned `tweets[]` structure in OpenClaw context.
3. Map ordinal follow-up requests to remembered tweet or author context.
4. If multiple user candidates match a natural-language name, stop and ask the user to confirm the account.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/post_twitter.md (reported line 87)May include surrounding context.

md

When the user asks to like, unlike, follow, or unfollow on X/Twitter:

1. Do not ask the user to manually paste tweet links or IDs.
2. If the user first asked to query tweets, keep the returned `tweets[]` structure in OpenClaw context.
3. Map ordinal follow-up requests to remembered tweet or author context.
4. If multiple user candidates match a natural-language name, stop and ask the user to confirm the account.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file and CLI are described as read-only, but the shared request helper can issue POST requests with arbitrary JSON bodies. In an agent-skill context, this mismatch can cause downstream components or reviewers to trust the tool as non-mutating even though the code path already permits write-capable API calls if new endpoints are added or endpoint strings are influenced elsewhere.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This is the same underlying security design issue expressed as misleading documentation: operators are told the module is for read-only Twitter access while the implementation retains generic POST capability. In approval-based agent systems, inaccurate capability labeling undermines safety review and may enable unintended state-changing actions through a supposedly safe research tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This client directly performs like/unlike and follow/unfollow operations as soon as the corresponding command is invoked, with no in-script confirmation gate, dry-run step, or proof that an explicit final user approval artifact was collected. In a skill specifically designed to trigger social-media write actions, that omission increases the chance of unintended account actions from agent mistakes, prompt confusion, or misuse of pre-resolved IDs.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

DEFAULT_TIMEOUT = 30
DEFAULT_BASE_URL = "https://api.aisa.one/apis/v1/twitter"
DEFAULT_CHROME_USER_AGENT = (
    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
    "AppleWebKit/537.36 (KHTML, like Gecko) "

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/twitter_client.py (reported line 35)May include surrounding context.

python

DEFAULT_TIMEOUT = 30
DEFAULT_BASE_URL = "https://api.aisa.one/apis/v1/twitter"
DEFAULT_CHROME_USER_AGENT = (
    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
    "AppleWebKit/537.36 (KHTML, like Gecko) "

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/twitter_oauth_client.py (reported line 29)May include surrounding context.

python

DEFAULT_TIMEOUT = 30
DEFAULT_BASE_URL = "https://api.aisa.one/apis/v1/twitter"
DEFAULT_CHROME_USER_AGENT = (
    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
    "AppleWebKit/537.36 (KHTML, like Gecko) "

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring lists authorize [--callback-url <url>] [--open-browser], implying browser-assisted authorization behavior and a callback option. In the implementation, --callback-url is not implemented at all, and --open-browser only prints that auto-open is disabled rather than opening a browser.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.