ClawHub
Back to skill

Security audit

Twitter Post AIsa

Security checks for vulnerabilities and agentic risk

Overview

This Twitter/X skill is mostly purpose-aligned, but it should be reviewed because it exposes the AIsa API key in normal output and can upload arbitrary local media paths.

Install only if you trust AIsa with the API key, Twitter/X action requests, and uploaded media. Avoid sharing command output from authorize or post because it may include the full AISA_API_KEY, rotate any key already exposed in logs, and only pass media files you intentionally want sent to AIsa and Twitter/X.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/twitter_oauth_client.py:342
Finding

AIsa API Key Is Exposed in Command Output

Content
View full analysis
None: config = load_config(args) payload = {"aisa_api_key": config["aisa_api_key"]} result = send_json_request( f"{config['base_url']}/twitter/auth_twitter", payload, timeout=config["timeout"], aisa_api_key=config["aisa_api_key"], ) if result.get("ok") is False: print(json.dumps(result, indent=2, ensure_ascii=False)) sys.exit(1) auth_url = (result.get("data") or {}).get("auth_url") output = { "ok": result.get("code") == 200 and bool(auth_url), "aisa_api_key": config["aisa_api_key"], "authorization_url": auth_url, "raw_response": result, } print(json.dumps(output, indent=2, ensure_ascii=False)) ``` ### Technical Analysis The OAuth client inserts the complete `AISA_API_KEY` into success and failure result objects. These objects are serialized and pri ...[truncated 1837 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/twitter_oauth_client.py:379
Finding

AIsa API Key Is Redundantly Sent in Both Authorization Headers and Request Bodies

Content
View full analysis
Dict[str, str]: headers = { "Authorization": f"Bearer {aisa_api_key}", "User-Agent": DEFAULT_CHROME_USER_AGENT, } if extra_headers: headers.update(extra_headers) return headers ``` ```python def post_single_tweet( config: Dict[str, Any], *, content: Optional[str] = None, media_ids: Optional[list[str]] = None, media_files: Optional[list[Dict[str, Any]]] = None, parent_tweet_id: Optional[str] = None, post_type: Optional[str] = None, ) -> Dict[str, Any]: payload: Dict[str, Any] = { "aisa_api_key": config["aisa_api_key"], } if content: payload["content"] = content if post_type: payload["type"] = post_type if media_ids: payload["media_ids"] = media_ids if parent_tweet_id: parent_key = "in_reply_to_tweet_id" if post_type == "reply" else "quote_tweet_id" payload[parent_key] = parent_tweet_id endpoint = f"{config['base_url']}/twitter/post_twitter" if media_files: return send_multipart_request( endpoint, payload, media_files, timeout=config["timeout"], aisa_api_key=config["aisa_api_key"], ) return send_json_request( endpoint, payload, timeout=config["timeout"], aisa_api_key=config["aisa_api_key"], ) ``` ```python def command_authorize(args: argparse.Namespace) -> None: config = load_config(args) payload = {"aisa_api_key": config["aisa_api_key"]} result = send_json_request( f"{config['base_url']}/twitte ...[truncated 3267 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/twitter_oauth_client.py:416
Finding

Media Upload Can Read Files Outside the Documented Workspace Boundary

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description emphasizes explicit engagement workflows and approved posting: likes, follows, replies, and OAuth-gated posting. The supplied code does not implement any write or engagement endpoints at all. Every exposed method and CLI command is read-only, using GET requests for information retrieval, except for generic POST support in the request helper that is never used by any feature shown. The actual primary purpose is Twitter/X data retrieval and context gathering, not engagement execution. While the description mentions read context support, that is only a subset of the implementation and does not accurately represent the code’s overall omission of the declared action capabilities.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The description broadly claims support for read context, engagement actions, and approved posting, specifically mentioning likes, follows, replies, and OAuth-gated posting. The supplied code matches part of that: it reads tweet context (list-tweets), resolves users, and performs like/unlike and follow/unfollow actions through AIsa endpoints. However, there is no implementation of replies or any posting flow, OAuth-gated or otherwise. The only supported relay endpoints are /like_twitter, /unlike_twitter, /follow_twitter, and /unfollow_twitter, and the supported commands list likewise lacks reply/post commands. Additionally, the code includes a status command that reveals relay base URL, API key presence, timeout, and supported commands/endpoints, which is an extra operational capability not reflected in the description. Because key declared capabilities are absent in the code chunk, the description does not accurately represent the actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The description overstates the implemented Twitter engagement scope. The code only supports three CLI commands: authorize, post, and status. Posting supports text, replies, quote-style posting, media attachment by ID or local file upload, and automatic splitting/threading of oversized content. It also requests an OAuth authorization URL through AIsa. However, there is no code for liking tweets, following accounts, or reading Twitter context/timeline/content. Because those are central declared capabilities, the description does not accurately represent the actual behavior. The extra implemented details (status/config output, media upload, chunk/thread logic) are secondary, but the missing declared engagement actions are material enough to mark this as a mismatch.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The status/post flows include the full AIsa API key in printed JSON output, which can leak the credential to terminal history, logs, CI job output, screenshots, or other local telemetry. In this skill’s context, the key authorizes OAuth and posting actions to a third-party service, so disclosure can enable unauthorized posting or account operations through the relay.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The authorization command prints the full AIsa API key alongside the authorization URL and raw response. This unnecessarily exposes a bearer credential during a workflow that may be copied, shared, or logged, and the exposed key could be reused to perform API actions against the AIsa relay.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding

The skill declares access to an API key and documents outbound network access to a fixed third-party endpoint, but it does not declare an explicit tool scope or allowed-tools policy. That omission weakens least-privilege controls and makes it harder for a host agent or reviewer to understand and constrain what capabilities the skill will use.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill explicitly sends data, OAuth requests, and potentially uploaded local media to a fixed external endpoint operated by AIsa. External transmission is expected for this skill, but it is still security-relevant because API keys, tweet content, account context, and attached files may leave the local environment and be exposed to third-party handling, logging, or compromise.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
- `AISA_API_KEY` is required for AIsa-backed API access.
- Use repo-relative `scripts/` paths from the shipped package.
- Twitter/X reads, OAuth requests, and user-approved media uploads use the fixed AIsa API endpoint `https://api.aisa.one/apis/v1/twitter`.
- Provide only `AISA_API_KEY`; do not use passwords, cookies, or browser credential export.

## Example Requests

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/engage_twitter.md (reported line 27)May include surrounding context.

md
When the user asks to like, unlike, follow, or unfollow on X/Twitter:

1. Do not ask the user to manually paste tweet links or IDs.
2. If the user first asked to query tweets, keep the returned `tweets[]` structure in the current agent context.
3. Map ordinal follow-up requests to remembered tweet or author context.
4. If multiple user candidates match a natural-language name, stop and ask the user to confirm the account.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/post_twitter.md (reported line 86)May include surrounding context.

md
When the user asks to like, unlike, follow, or unfollow on X/Twitter:

1. Do not ask the user to manually paste tweet links or IDs.
2. If the user first asked to query tweets, keep the returned `tweets[]` structure in the current agent context.
3. Map ordinal follow-up requests to remembered tweet or author context.
4. If multiple user candidates match a natural-language name, stop and ask the user to confirm the account.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The module docstring and usage text describe the file as providing only 'Twitter/X read APIs', and the CLI description repeats that read-only framing. However, the core _request method explicitly supports POST bodies, which contradicts the file-level intent documentation and indicates the client is built for write operations too.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script exposes follow, unfollow, like, and unlike operations as direct command handlers with no built-in confirmation, approval gate, or high-friction check before executing state-changing social-media actions. In an agent-skill context, this increases the chance of unintended account actions from ambiguous prompts, prompt injection in upstream workflow, or accidental invocation, causing reputational harm and unauthorized engagement from the connected account.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/twitter_client.py (reported line 35)May include surrounding context.

python
DEFAULT_TIMEOUT = 30
DEFAULT_BASE_URL = "https://api.aisa.one/apis/v1"
DEFAULT_CHROME_USER_AGENT = (
    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
    "AppleWebKit/537.36 (KHTML, like Gecko) "

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/twitter_oauth_client.py (reported line 29)May include surrounding context.

python
DEFAULT_TIMEOUT = 30
DEFAULT_BASE_URL = "https://api.aisa.one/apis/v1"
DEFAULT_CHROME_USER_AGENT = (
    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
    "AppleWebKit/537.36 (KHTML, like Gecko) "

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Including a sensitive API key in normal command output without warning is unsafe because users may assume the JSON is safe to paste into tickets, chat, or logs. While this overlaps with the direct secret-disclosure issue, the lack of warning and safe handling guidance increases the likelihood of accidental exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The authorize command emits the API key in JSON with no caution to the user, increasing the chance that it is copied into support messages or persisted in shell history/logging systems. In an OAuth-related workflow, users are especially likely to share output while troubleshooting, making accidental credential disclosure more likely.

Content

No source excerpt is available for this finding.