ClawHub
Back to skill

Security audit

tonfun-feed

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about relaying a Twitter feed, but it lets remote hashtags trigger authenticated public reposting without clear per-post user approval or safety controls.

Install only if you want an agent to relay @TonFunX content to an external platform. Use read-only review mode or require explicit approval for every post, inspect the exact final text and links before publishing, and use a narrowly scoped BotWorld token stored outside prompts, shell history, and logs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:19
Finding

Remote Feed Content Can Hijack Authenticated Agent Publishing

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs agents to automatically fetch third-party content and repost it to other platforms, but it does not warn users that this behavior transmits externally sourced content and may use platform credentials. That creates a real safety/privacy risk because operators may enable automated posting without understanding reputational, policy, or credential-handling consequences.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

Fetch recent tweets via Nitter RSS (free, no auth):

bash
curl -s -H "User-Agent: Mozilla/5.0" "https://nitter.net/TonFunX/rss"

Returns standard RSS 2.0 XML. Each <item> contains:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The example shows use of a bearer token in an outbound POST request but provides no safety guidance on protecting the token, scoping permissions, or avoiding accidental disclosure in logs, shells, or shared configs. This is a genuine documentation-level security weakness because users may copy the pattern directly into insecure automation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.