ClawHub
Back to skill

Security audit

X Search Bwm

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward X/Twitter search helper that sends user searches to xAI using a declared API key, with no hidden persistence or unrelated local access found.

Install this only if you are comfortable sending your X/Twitter search terms, filters, and API-authenticated requests to xAI. Avoid searching for secrets, private personal data, or confidential internal topics unless your xAI account and data-handling expectations allow it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill invokes Python, reads an API key from environment/config, and makes outbound requests to xAI, but it does not declare an explicit tool scope such as permissions or allowed-tools. That weakens least-privilege controls and makes the skill's capabilities less transparent to the host and user, increasing the chance of unintended execution with broader access than necessary.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The invocation guidance says to use the skill when the user wants to "find tweets," "search X/Twitter," "look up what people are saying on X," or "find social media posts about a topic." These are broad natural-language triggers without exclusions or negative examples, which could cause the skill to be selected for ordinary conversation about social media rather than an explicit request to run this tool.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The documentation explains how to run searches but does not clearly warn that user-provided queries are transmitted to an external xAI service. Users may enter sensitive internal terms, personal data, or confidential investigation topics without realizing that content leaves the local environment, creating a privacy and data-handling risk.

External Transmission

Medium
Category
Data Exfiltration
Content
def redirect_request(self, req, fp, code, msg, headers, newurl):
        raise HTTPError(newurl, code, f"Redirect to {newurl} blocked (auth safety)", headers, fp)

API_URL = "https://api.x.ai/v1/responses"
MODEL = "grok-4.20-reasoning"
TIMEOUT_S = 120
MAX_HANDLES = 10
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Context-Inappropriate Capability

Low
Confidence
76% confidence
Finding
The manifest frames this skill as searching X posts, but the implementation also depends on reading the XAI_API_KEY environment variable. Accessing environment-held secrets is a separate capability from search itself and is not mentioned in the stated purpose, even though it is used to enable the API call.

Missing User Warnings

Low
Confidence
87% confidence
Finding
This code sends the user's query to the remote xAI API over HTTP, which is a network operation that transmits user-provided data off-system. While the module docstring says it uses the Grok API, there is no runtime disclosure, confirmation, or warning near execution to remind users that their search input will be sent to an external service.

Static analysis

No suspicious patterns detected.