ClawHub
Back to skill

Security audit

OpenClaw X

Security checks for vulnerabilities and agentic risk

Overview

The skill is openly meant to control an X/Twitter account, but it requires exported browser login cookies and an unverified downloaded executable with too little security scoping.

Review carefully before installing. Treat cookies.json like a password for your X/Twitter account, do not place it in synced or shared folders, and avoid using this unless you trust the downloaded executable and can isolate it. Prefer a version that uses OAuth or another scoped, revocable authentication method, verifies the executable, and requires authentication or confirmation for posting and engagement actions.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:10
Finding

Unverified Remote Executable Handles Account Credentials

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–14
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code Snippet:

markdown
## Prerequisites

1. Download the executable from [GitHub Release](https://github.com/bosshuman/openclaw-x/releases)
2. Export your X cookies from Chrome (using Cookie-Editor extension), save as `cookies.json` in the same directory
3. Run the executable, ensure the service is running at `http://localhost:19816`

Technical Analysis

The Skill instructs users to download and execute a precompiled binary from an external release page. It does not pin an immutable release, specify a cryptographic checksum, require signature verification, or provide source code and reproducible-build instructions.

The externally hosted executable can change after the Skill has been reviewed. A compromised publisher account, release pipeline, or distribution artifact could therefore replace the expected application with malicious code. The risk is elevated because the downloaded executable is explicitly given access to exported X/Twitter session cookies.

The reviewed project contains only SKILL.md; consequently, the executable's actual credential handling, network activity, and local system behavior cannot be verified from the available source.

Attack Path

  1. An attacker compromises the upstream publisher account, release pipeline, or downloadable release artifact.
  2. The attacker replaces the legitimate executable with a malicious binary.
  3. A user follows the Skill instructions and downloads the modified executable.
  4. The user stores authenticated X/Twitter cookies in the executable's directory.
  5. The user runs the executable without integrity or signature verification.
  6. The malicious executable reads the session cookies and may transmit them to an attacker or execute arbitrary code under the user's operating-system account.

...[truncated 440 chars]

Remediation
View remediation

Remediation Suggestions

  • Include auditable source code in the project and provide reproducible-build instructions.
  • Pin downloads to a specific immutable release and commit revision.
  • Publish a SHA-256 checksum through a separately protected channel and require users to verify it before execution.
  • Digitally sign release artifacts and document mandatory signature verification.
  • Protect the release pipeline with least-privilege credentials, multi-factor authentication, and provenance attestations.
  • Run the service in a sandbox or dedicated low-privilege account with restricted filesystem and network access.
  • Avoid granting the executable access to reusable browser session cookies; use a narrowly scoped, revocable authorization mechanism instead.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:11
Finding

Plaintext Browser Session Cookies Stored Beside an Untrusted Executable

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11–13
Vulnerability Type: Insecure storage of sensitive authentication data
Risk Level: High

Vulnerable Code Snippet:

markdown
1. Download the executable from [GitHub Release](https://github.com/bosshuman/openclaw-x/releases)
2. Export your X cookies from Chrome (using Cookie-Editor extension), save as `cookies.json` in the same directory
3. Run the executable, ensure the service is running at `http://localhost:19816`

Technical Analysis

Exported browser cookies are sensitive bearer credentials. Any process or person able to read a valid session cookie may be able to impersonate the authenticated user without knowing the account password.

The instructions require users to save these credentials as cookies.json in the same directory as a remotely downloaded executable. They do not define restrictive file permissions, encryption at rest, secure deletion, retention limits, log-redaction requirements, or credential rotation procedures.

This design unnecessarily exposes reusable authentication material to the downloaded executable, other local processes with sufficient permissions, backup software, directory synchronization tools, and accidental file sharing.

Attack Path

  1. A user exports active X/Twitter cookies from the browser.
  2. The cookies are saved as a plaintext cookies.json file beside the executable.
  3. A malicious or compromised executable, another local process, a backup mechanism, or a user with filesystem access reads the file.
  4. The attacker copies the reusable session values.
  5. The attacker replays the cookies while the session remains valid and impersonates the victim's account.

Impact Assessment

Exploitation may grant access equivalent to the victim's active X/Twitter web session. Depending on platform-side controls, an attacker may read account-specific content and perform actions such as posting twee ...[truncated 190 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace exported browser cookies with an official OAuth flow using narrowly scoped, revocable, and short-lived tokens.
  • Store credentials in the operating system's protected credential store rather than in the executable directory.
  • If a credential file is unavoidable, require owner-only file permissions and reject files with insecure permissions.
  • Encrypt sensitive credentials at rest using keys maintained outside the application directory.
  • Prevent credentials from appearing in logs, crash reports, backups, synchronization folders, or version control.
  • Define a short retention period and securely delete exported cookies immediately after use.
  • Document procedures for revoking the affected session and rotating credentials after suspected exposure.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:39
Finding

Account-Changing Local API Has No Documented Authentication Control

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39–74
Vulnerability Type: Missing authentication for privileged local API operations
Risk Level: High

Vulnerable Code Snippet:

markdown
### 4. Post a Tweet

```bash
curl -X POST http://localhost:19816/tweet \
  -H "Content-Type: application/json" \
  -d '{"text": "Hello world"}'

Reply to a tweet:

bash
curl -X POST http://localhost:19816/tweet \
  -H "Content-Type: application/json" \
  -d '{"text": "Reply content", "reply_to": "original_tweet_id"}'

5. Like a Tweet

bash
curl -X POST http://localhost:19816/tweet/{tweet_id}/like

6. Retweet

bash
curl -X POST http://localhost:19816/tweet/{tweet_id}/retweet

7. Bookmark a Tweet

bash
curl -X POST http://localhost:19816/tweet/{tweet_id}/bookmark
text

### Technical Analysis

The documented state-changing requests contain no bearer token, API key, client authentication, anti-CSRF value, or confirmation mechanism. Binding a service to localhost can reduce direct remote exposure, but localhost is not an authentication boundary: other processes running in the user's environment can connect to local ports.

Depending on implementation details not available in the audited project, malicious web content may also be able to attempt browser-originated requests to a localhost service. Relevant defenses—including strict loopback binding, `Host` and `Origin` validation, restrictive CORS behavior, content-type enforcement, and unpredictable authentication tokens—are not documented.

Because the service executable was not included, this finding establishes that the documented interface lacks an authentication requirement; it cannot independently confirm whether undocumented controls exist inside the binary.

### Attack Path

1. The victim runs the service with valid X/Twitter session cookies.
2. An attacker gains the ability to issue 
...[truncated 988 chars]
Remediation
View remediation

Remediation Suggestions

  • Require a cryptographically random, per-installation bearer token for every API endpoint.
  • Store the token in a protected credential store and never place it in command history, logs, or URLs.
  • Bind exclusively to an explicit loopback address and fail securely if loopback binding is unavailable.
  • Validate the Host header and reject unrecognized hosts to reduce DNS-rebinding exposure.
  • Validate browser Origin headers and use a deny-by-default CORS policy.
  • Require non-simple request content types and appropriate anti-CSRF controls for any browser-accessible workflow.
  • Add explicit user confirmation for public or destructive account actions.
  • Apply rate limiting, request-size limits, audit logging with secret redaction, and automatic session expiration.
  • Document all authentication and authorization controls in the Skill instructions and include security tests for unauthenticated requests.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
93% confidence
Finding

Requiring users to export browser cookies from Chrome is a strong credential-handling red flag because session cookies can authenticate as the user without a password or MFA prompt. In this skill's context, those cookies enable a downloaded executable and local API to fully control the user's X account, so compromise or misuse could lead to account takeover and unauthorized actions.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

name: openclaw-x version: 0.1.0 description: Control your X/Twitter account — view timeline, search tweets, post, like, retweet, bookmark.

OpenClaw X

Control your X/Twitter account via a local API.

Prerequisites

  1. Download the executable from GitHub Release
  2. Export your X cookies from Chrome (using Cookie-Editor extension), save as cookies.json in the same directory
  3. Run the executable, ensure the service is running at http://localhost:19816

Available Actions

1. Get Home Timeline

bash
curl http://localhost:19816/timeline?count=20

Returns the latest tweets including content, author, media URLs, etc.

2. Get Tweet Details

bash
curl http://localhost:19816/tweet/{tweet_id}

Supports both tweet ID and full URL (e.g. https://x.com/user/status/123456).

3. Search Tweets

bash
curl "http://localhost:19816/search?q=keyword&so

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The description says the skill can control an X/Twitter account, but it does not clearly warn that the skill can perform state-changing actions such as posting, liking, retweeting, and bookmarking on the user's behalf. In a social-media automation context, lack of conspicuous warning increases the chance of unintended account actions and user consent issues.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs users to export X/Twitter authentication cookies from Chrome and place them beside a downloaded executable, but provides no warning that these cookies are effectively account credentials. Anyone who obtains the cookies or abuses the local service can likely act as the user on X, making this omission dangerous in a skill specifically designed to control an account.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

1. Get Home Timeline

bash
curl http://localhost:19816/timeline?count=20

Returns the latest tweets including content, author, media URLs, etc.

Static analysis

No suspicious patterns detected.