xAI / Grok

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:23 PM UTC
• Version: 1.0.2

Overview

This appears to be a real xAI/Grok integration, but it needs review because image uploads can transmit unintended local files and one documented install path is not pinned to an audited version.

Install only from the reviewed ClawHub package or a pinned commit. Treat every prompt and image as being sent to xAI, avoid secrets or regulated data, and do not use the image option on symlinks, renamed non-images, or files you have not personally selected.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/chat.js:51

Finding

Extension-Only Image Validation Allows Unintended Local File Disclosure

Content

View full analysis

{ ``` ### Technical Analysis The `imageToBase64` function determines whether a file is an image solely from its filename extension. It does not inspect file signatures or decoded image structure, reject symbolic links, verify that the path identifies a regular file, restrict access to an approved directory, or impose a file-size limit. Consequently, a file containing arbitrary non-image data can be read ...[truncated 2204 chars]

Remediation

View remediation

MAX_IMAGE_SIZE) { throw new Error('Image exceeds the permitted size'); } // Detect and decode the image format from its contents before transmission. ``` ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:8

Finding

Documented Installation Uses an Unpinned Mutable Git Repository

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 2)May include surrounding context.

text

node_modules/
.env
*.log

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared purpose centers on chatting with Grok models through the xAI API. However, this code only retrieves and displays the list of available xAI models using a GET request to /v1/models. It does not accept a user prompt, invoke a chat/completions endpoint, handle conversational exchanges, or demonstrate vision support. While listing models may be related to an xAI integration, the primary behavior of this code chunk is materially different from the declared chat functionality, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description presents the skill as a general Grok chat capability across multiple models, including vision. The actual code is narrowly focused on searching X/Twitter content using xAI's x_search tool through the Responses API. Its primary purpose is retrieving and citing real posts within date/handle constraints, not carrying on arbitrary conversations with Grok. There is no evidence of image or vision handling, no general chat loop, and no broad model-support logic beyond accepting a model argument. This is a material purpose and capability mismatch, not just an implementation detail.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md

- `scripts/models.js` lists available models (read-only)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md

- `scripts/models.js` lists available models (read-only)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md

**Bundled scripts:** `scripts/chat.js` (chat), `scripts/models.js` (list models), `scripts/search-x.js` (X search)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · scripts/search-x.js (reported line 222)May include surrounding context.

js

--handles <list>        Only search these handles (comma-separated)
  --exclude <list>        Exclude these handles (comma-separated)
  --json, -j              Output full JSON response
  --no-require-citations  Don't warn if no X citations found
  --help                  Show this help

Examples:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README describes chat and vision capabilities but does not warn that prompts and images are transmitted to xAI's external API. This creates a privacy and data-handling risk because users may provide sensitive text or images without understanding that their content leaves the local environment and is processed by a third party.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README suggests broad natural-language invocations like "Ask Grok about [topic]" and "Have Grok 4 explain [concept]," which can overlap with ordinary conversation. In an agent ecosystem, overly generic triggers increase the chance of accidental activation, causing user content or attached images to be sent to the external xAI service when the user did not clearly intend that routing.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill declares access to an environment secret (XAI_API_KEY) but does not define an explicit tool/permission scope. That makes the trust boundary unclear and can enable broader-than-expected secret exposure when the skill is invoked or later extended with scripts that read env vars. In this context, the skill is network-facing and API-key driven, so undeclared capability scope is a meaningful security hygiene issue.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 82% confidence

Finding

The trigger ask grok overlaps with the generic built-in command ask, creating ambiguity in command routing. That can cause unintended invocation of this external-network skill when a user intended a normal built-in action, potentially sending prompts or attached images to a third-party API without clear user intent. Because this skill transmits data off-platform, trigger confusion is more security-relevant than a normal naming collision.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This script sends user prompts and, when provided, local image contents to xAI's external API, but it does not provide an explicit disclosure or confirmation to the user at the point of transmission. In an agent-skill context, users may invoke the tool assuming local-only processing, which can lead to unintended exfiltration of sensitive text or images to a third party.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest says the skill is for chatting with Grok models via the xAI API, but this script is narrowly built around the x_search tool and constructs a search-specific prompt for finding real X/Twitter posts. That is a meaningful behavior mismatch because the file's actual purpose is social-post search, not general model chat.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.