ClawHub
Back to skill

Security audit

Falcon

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Twitter/X automation CLI, but it delegates a full Twitter session cookie to a third-party API for account-changing actions and includes broad local Bash permissions.

Install only if you are comfortable trusting TwexAPI with a reusable Twitter/X session cookie and with the ability to act on that account. Prefer a version that uses scoped OAuth credentials, removes broad local Bash allowlist entries, and enforces an in-tool confirmation or dry-run before every post, follow, like, retweet, bookmark, or deletion-style action.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
falcon.sh:282
Finding

Reusable Twitter Session Cookie Disclosed to a Third-Party API

Content
View full analysis

Vulnerability Details

File Location: falcon.sh:7, falcon.sh:79-110, and falcon.sh:282-365
Vulnerability Type: Sensitive credential delegation to a third-party service
Risk Level: High

Vulnerable Code

bash
BASE_URL="https://api.twexapi.io"
bash
api_post() {
  need TWEXAPI_KEY
  local path="$1"
  local body="$2"
  local hdr_file body_file
  hdr_file=$(_mktemp)
  body_file=$(_mktemp)
  printf 'Authorization: Bearer %s\n' "$TWEXAPI_KEY" > "$hdr_file"
  printf 'Content-Type: application/json\n' >> "$hdr_file"
  printf '%s' "$body" > "$body_file"
  curl -sS --fail-with-body \
    -X POST \
    -H @"$hdr_file" \
    -d @"$body_file" \
    "${BASE_URL}${path}" | jq .
}

api_delete() {
  need TWEXAPI_KEY
  local path="$1"
  local body="$2"
  local hdr_file body_file
  hdr_file=$(_mktemp)
  body_file=$(_mktemp)
  printf 'Authorization: Bearer %s\n' "$TWEXAPI_KEY" > "$hdr_file"
  printf 'Content-Type: application/json\n' >> "$hdr_file"
  printf '%s' "$body" > "$body_file"
  curl -sS --fail-with-body \
    -X DELETE \
    -H @"$hdr_file" \
    -d @"$body_file" \
    "${BASE_URL}${path}" | jq .
}
bash
cmd_tweet() {
  [[ $# -ge 1 ]] || die "usage: falcon tweet <text>"
  require_cookie
  local json
  json=$(jq -n --arg text "$1" --arg cookie "$TWITTER_COOKIE" \
    '{tweet_content: $text, cookie: $cookie}')
  api_post "/twitter/tweets/create" "$json"
}

The same cookie-forwarding pattern is used by the reply, quote, like, unlike, retweet, bookmark, follow, and unfollow commands in falcon.sh:288-365.

Technical Analysis

The write and engagement commands embed the complete TWITTER_COOKIE value in a JSON request body and transmit it to https://api.twexapi.io. A Twitter authentication cookie is a reusable session credential and may provide broader account authority than the individual operation requested by the use ...[truncated 1770 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace session-cookie delegation with the official Twitter/X OAuth flow using narrowly scoped access tokens.
  2. Request only the permissions required for the selected operation and avoid transmitting a reusable browser session credential.
  3. If TwexAPI must remain involved, use short-lived, action-specific delegated tokens that cannot be replayed for unrelated account operations.
  4. Require explicit confirmation immediately before every write or engagement request, including a clear warning that an external service will receive authentication material.
  5. Define and document credential retention, logging, encryption, incident response, and deletion policies for the external API.
  6. Provide clear session-revocation instructions and advise users to rotate or revoke credentials after suspected exposure.
  7. Prevent request and error logging from recording cookie-bearing JSON bodies at every layer.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
.claude/settings.local.json:3
Finding

Overbroad Local Bash Permission Allowlist

Content
View full analysis

Vulnerability Details

File Location: .claude/settings.local.json:3-14
Vulnerability Type: Excessive agent tool permissions
Risk Level: Medium

Vulnerable Code

json
{
  "permissions": {
    "allow": [
      "WebFetch(domain:docs.openclaw.ai)",
      "WebFetch(domain:docs.twitterxapi.com)",
      "Bash(chmod:*)",
      "Bash(bash -n /home/user/Documents/Falcon/falcon)",
      "Bash(/home/user/Documents/Falcon/falcon help:*)",
      "Bash(/home/user/Documents/Falcon/falcon check)",
      "Bash(shellcheck:*)",
      "Bash(/home/user/Documents/Falcon/falcon read:*)",
      "Bash(echo:*)",
      "Bash(/home/user/Documents/Falcon/falcon:*)"
    ]
  }
}

Technical Analysis

The local settings grant wildcard Bash permissions, including unrestricted argument patterns for chmod, echo, and the Falcon command. These permissions exceed the minimum access needed to run the audited Skill.

In particular, Bash(chmod:*) can authorize permission changes against arbitrary files accessible to the current operating-system user. Generic wildcard command rules also enlarge the set of operations that may execute without a separate approval boundary. The exact exploitability of shell metacharacters depends on the host agent's command matching and execution semantics, but the configuration unnecessarily increases the consequences of prompt manipulation or unsafe command construction.

The allowlist also references an external development path, /home/user/Documents/Falcon/falcon, rather than the script contained in the audited project. This makes the authorization dependent on the contents and integrity of a file outside the reviewed package.

Attack Path

  1. The project is opened in an environment that honors .claude/settings.local.json.
  2. The agent processes malicious or attacker-controlled instructions, or constructs an unsafe Bash command.
  3. The generated command matches a broad ...[truncated 1030 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove local development permission settings from the distributed Skill package.
  2. Delete broad rules such as Bash(chmod:*) and Bash(echo:*) unless they are strictly required.
  3. Authorize only the packaged falcon.sh script through its resolved project-relative or verified installation path.
  4. Define separate, narrowly scoped rules for required read-only subcommands rather than allowing the entire command prefix.
  5. Keep every write and engagement command behind an explicit user-confirmation boundary.
  6. Ensure the permission engine rejects shell operators, command substitutions, redirections, and argument patterns outside the expected command grammar.
  7. Do not authorize executables outside the reviewed project unless their path, ownership, permissions, and integrity are independently verified.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill description emphasizes search/read interaction, but the documented behavior includes high-impact state-changing actions such as posting, replying, liking, retweeting, bookmarking, and following accounts using authentication material. This mismatch can mislead operators, reviewers, or calling agents into treating the skill as low-risk read-only functionality when it can perform public or account-modifying actions.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · falcon.sh (reported line 15)May include surrounding context.

sh
# ---------------------------------------------------------------------------

_tmp_files=()
_cleanup() { [[ ${#_tmp_files[@]} -gt 0 ]] && rm -f "${_tmp_files[@]}" || true; }
trap _cleanup EXIT

_mktemp() {

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script sends the full TWITTER_COOKIE value to api.twexapi.io in JSON bodies for write operations, effectively delegating account control to a third-party service. This is highly sensitive authentication material, and transmitting it off-platform without an explicit warning, consent flow, or minimization exposes the user to account takeover, session theft, or misuse if the API provider, logs, or network path are compromised.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill exposes shell-based command execution via command-tool: Bash and command-arg-mode: raw but does not declare any tool scope restrictions such as permissions or allowed-tools. This weakens policy enforcement and increases the chance that an agent can invoke broader shell capabilities than reviewers or users expect, especially if the backing script later grows beyond simple API calls.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · falcon.sh (reported line 21)May include surrounding context.

sh
_mktemp() {
  local f
  f=$(mktemp)
  chmod 600 "$f"
  _tmp_files+=("$f")
  echo "$f"
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · falcon.sh (reported line 88)May include surrounding context.

sh
printf 'Authorization: Bearer %s\n' "$TWEXAPI_KEY" > "$hdr_file"
  printf 'Content-Type: application/json\n' >> "$hdr_file"
  printf '%s' "$body" > "$body_file"
  curl -sS --fail-with-body \
    -X POST \
    -H @"$hdr_file" \
    -d @"$body_file" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · falcon.sh (reported line 106)May include surrounding context.

sh
printf 'Authorization: Bearer %s\n' "$TWEXAPI_KEY" > "$hdr_file"
  printf 'Content-Type: application/json\n' >> "$hdr_file"
  printf '%s' "$body" > "$body_file"
  curl -sS --fail-with-body \
    -X DELETE \
    -H @"$hdr_file" \
    -d @"$body_file" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The write-capable commands immediately perform irreversible or account-affecting actions such as tweeting, following, liking, and retweeting with no confirmation step, dry-run mode, or prominent runtime warning. In an agent/skill context, this materially increases the chance of accidental or prompt-induced actions against a real social account.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.