ClawHub
Back to skill

Security audit

TwitterApi Research

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real X/Twitter research CLI, but users should review it because it can send broad user queries to a third-party API and uses an overbroad shared credential file.

Install only if you are comfortable with X/Twitter research queries going to twitterapi.io and with API credit usage. Prefer setting only TWITTERAPI_IO_KEY in the environment instead of sourcing a shared global.env file, keep unrelated secrets out of that file, and use explicit X/Twitter search requests rather than broad auto-invocation or unattended heartbeat checks.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Note
Location
lib/api.ts:18
Finding

Overbroad Access to a Shared Credential File

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (17)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The top-level description frames the skill as general X research and says it is not for account management, but the documented behavior includes profile lookups, thread/tweet retrieval, persistent watchlist management, bulk monitoring, and local file writes. This mismatch can cause users or orchestration systems to grant or trigger the skill under narrower assumptions than its actual data collection and persistence capabilities warrant.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 20)May include surrounding context.

Claude Code

bash
# From your project
mkdir -p .claude/skills
cd .claude/skills
git clone https://github.com/rohunvora/x-research-skill.git x-research

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 20)May include surrounding context.

Claude Code

bash
# From your project
mkdir -p .claude/skills
cd .claude/skills
git clone https://github.com/rohunvora/x-research-skill.git x-research

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README advertises broad natural-language triggers such as 'what are people saying about' and 'check X for', which can overlap with ordinary conversation and cause the skill to activate when the user did not explicitly intend to invoke an external-search capability. In an agent environment, this can lead to unintended third-party API calls, unnecessary cost, and unplanned transmission of user queries to twitterapi.io.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 212)May include surrounding context.

md
## Star History

[![Star History Chart](https://api.star-history.com/svg?repos=rohunvora/x-research-skill&type=Date)](https://star-history.com/#rohunvora/x-research-skill&Date)

## License

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill invokes environment access (source ~/.config/env/global.env) and networked third-party API usage, but it declares no explicit tool scope or permission boundaries. That makes the agent's effective capabilities opaque to users and policy layers, increasing the chance of unintended secret exposure or unauthorized network actions when the skill is auto-invoked.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The invocation guidance uses broad conversational triggers like 'what are people saying about' and 'check x for,' which can overlap with ordinary user requests and cause over-selection of this skill. In combination with network access and third-party transmission, this raises the risk of sending user queries externally without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Although the skill mentions twitterapi.io, it does not give a clear privacy warning that user queries and retrieved targets will be transmitted to a third-party service. Users may unknowingly disclose sensitive topics, entities, or investigation targets to an external provider, creating privacy, confidentiality, and compliance risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill forwards user-supplied search queries and account identifiers to twitterapi.io, a third-party provider, without any user-visible consent or warning at the transmission point. Because X research queries may contain sensitive topics, proprietary project names, internal incident details, or targeted usernames, this can leak user intent and potentially sensitive operational context to an external service beyond the platform boundary.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest presents the skill as an X research/search agent and says nothing about writing files to the user's local filesystem. This file defines a drafts directory under the user's home and, when --save is used, writes markdown research reports there, adding a content-creation/storage behavior beyond the stated description.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest describes a general-purpose X/Twitter research agent focused on searching X for perspectives, discussions, and opinions, and explicitly contrasts it with a web research agent using X as the source. This file also creates and persists a local watchlist state with add/remove/check operations, which is a broader monitoring/workflow feature not reflected in the manifest description.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · README.md (reported line 7)May include surrounding context.

md
## What it does

Wraps the [twitterapi.io](https://twitterapi.io) third-party Twitter API into a fast CLI so your AI agent (or you) can search tweets, pull threads, monitor accounts, and get sourced research without writing curl commands. Full-archive search (not limited to 7 days), no official X developer account required.

- **Search** with engagement sorting, time filtering, noise removal
- **Quick mode** for cheap, targeted lookups

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
## What it does

Wraps the [twitterapi.io](https://twitterapi.io) third-party Twitter API into a fast CLI so your AI agent (or you) can search tweets, pull threads, monitor accounts, and get sourced research without writing curl commands. Full-archive search (not limited to 7 days), no official X developer account required.

- **Search** with engagement sorting, time filtering, noise removal
- **Quick mode** for cheap, targeted lookups

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md
## What it does

Wraps the [twitterapi.io](https://twitterapi.io) third-party Twitter API into a fast CLI so your AI agent (or you) can search tweets, pull threads, monitor accounts, and get sourced research without writing curl commands. Full-archive search (not limited to 7 days), no official X developer account required.

- **Search** with engagement sorting, time filtering, noise removal
- **Quick mode** for cheap, targeted lookups

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The manifest describes an X/Twitter research skill that searches and reads X content via a third-party API. Falling back to reading ~/.config/env/global.env introduces local file access for credential discovery, which is not an obvious part of the stated research behavior and is broader than the manifest describes.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 11)May include surrounding context.

json
"test:integration": "bun test tests/integration"
  },
  "devDependencies": {
    "@types/bun": "^1.0.0"
  }
}

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

For an X/Twitter research skill, network access to query X is expected, but reading environment-derived local path information is not inherently required by the manifest's stated purpose. Here it is used to support a local drafts export feature that itself is outside the clearly declared scope.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access, suspicious.potential_exfiltration

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
lib/api.ts:14

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
x-search.ts:40

Sensitive-looking file read is paired with a network send.

Warn
Code
suspicious.potential_exfiltration
Location
lib/api.ts:1