Falcon

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:49 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Twitter/X automation CLI, but it delegates a full Twitter session cookie to a third-party API for account-changing actions and includes broad local Bash permissions.

Install only if you are comfortable trusting TwexAPI with a reusable Twitter/X session cookie and with the ability to act on that account. Prefer a version that uses scoped OAuth credentials, removes broad local Bash allowlist entries, and enforces an in-tool confirmation or dry-run before every post, follow, like, retweet, bookmark, or deletion-style action.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: falcon.sh:282
• Finding: Reusable Twitter Session Cookie Disclosed to a Third-Party API## Vulnerability Details **File Location**: `falcon.sh:7`, `falcon.sh:79-110`, and `falcon.sh:282-365` **Vulnerability Type**: Sensitive credential delegation to a third-party service **Risk Level**: High ### Vulnerable Code ```bash BASE_URL="https://api.twexapi.io" ``` ```bash api_post() { need TWEXAPI_KEY local path="$1" local body="$2" local hdr_file body_file hdr_file=$(_mktemp) body_file=$(_mktemp) printf 'Authorization: Bearer %s\n' "$TWEXAPI_KEY" > "$hdr_file" printf 'Content-Type: application/json\n' >> "$hdr_file" printf '%s' "$body" > "$body_file" curl -sS --fail-with-body \ -X POST \ -H @"$hdr_file" \ -d @"$body_file" \ "${BASE_URL}${path}" | jq . } api_delete() { need TWEXAPI_KEY local path="$1" local body="$2" local hdr_file body_file hdr_file=$(_mktemp) body_file=$(_mktemp) printf 'Authorization: Bearer %s\n' "$TWEXAPI_KEY" > "$hdr_file" printf 'Content-Type: application/json\n' >> "$hdr_file" printf '%s' "$body" > "$body_file" curl -sS --fail-with-body \ -X DELETE \ -H @"$hdr_file" \ -d @"$body_file" \ "${BASE_URL}${path}" | jq . } ``` ```bash cmd_tweet() { [[ $# -ge 1 ]] || die "usage: falcon tweet <text>" require_cookie local json json=$(jq -n --arg text "$1" --arg cookie "$TWITTER_COOKIE" \ '{tweet_content: $text, cookie: $cookie}') api_post "/twitter/tweets/create" "$json" } ``` The same cookie-forwarding pattern is used by the reply, quote, like, unlike, retweet, bookmark, follow, and unfollow commands in `falcon.sh:288-365`. ### Technical Analysis The write and engagement commands embed the complete `TWITTER_COOKIE` value in a JSON request body and transmit it to `https://api.twexapi.io`. A Twitter authentication cookie is a reusable session credential and may provide broader account authority than the individual operation requested by the use ...[truncated 1770 chars]
• Remediation: ## Remediation Suggestions 1. Replace session-cookie delegation with the official Twitter/X OAuth flow using narrowly scoped access tokens. 2. Request only the permissions required for the selected operation and avoid transmitting a reusable browser session credential. 3. If TwexAPI must remain involved, use short-lived, action-specific delegated tokens that cannot be replayed for unrelated account operations. 4. Require explicit confirmation immediately before every write or engagement request, including a clear warning that an external service will receive authentication material. 5. Define and document credential retention, logging, encryption, incident response, and deletion policies for the external API. 6. Provide clear session-revocation instructions and advise users to rotate or revoke credentials after suspected exposure. 7. Prevent request and error logging from recording cookie-bearing JSON bodies at every layer.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: .claude/settings.local.json:3
• Finding: Overbroad Local Bash Permission Allowlist## Vulnerability Details **File Location**: `.claude/settings.local.json:3-14` **Vulnerability Type**: Excessive agent tool permissions **Risk Level**: Medium ### Vulnerable Code ```json { "permissions": { "allow": [ "WebFetch(domain:docs.openclaw.ai)", "WebFetch(domain:docs.twitterxapi.com)", "Bash(chmod:*)", "Bash(bash -n /home/user/Documents/Falcon/falcon)", "Bash(/home/user/Documents/Falcon/falcon help:*)", "Bash(/home/user/Documents/Falcon/falcon check)", "Bash(shellcheck:*)", "Bash(/home/user/Documents/Falcon/falcon read:*)", "Bash(echo:*)", "Bash(/home/user/Documents/Falcon/falcon:*)" ] } } ``` ### Technical Analysis The local settings grant wildcard Bash permissions, including unrestricted argument patterns for `chmod`, `echo`, and the Falcon command. These permissions exceed the minimum access needed to run the audited Skill. In particular, `Bash(chmod:*)` can authorize permission changes against arbitrary files accessible to the current operating-system user. Generic wildcard command rules also enlarge the set of operations that may execute without a separate approval boundary. The exact exploitability of shell metacharacters depends on the host agent's command matching and execution semantics, but the configuration unnecessarily increases the consequences of prompt manipulation or unsafe command construction. The allowlist also references an external development path, `/home/user/Documents/Falcon/falcon`, rather than the script contained in the audited project. This makes the authorization dependent on the contents and integrity of a file outside the reviewed package. ### Attack Path 1. The project is opened in an environment that honors `.claude/settings.local.json`. 2. The agent processes malicious or attacker-controlled instructions, or constructs an unsafe Bash command. 3. The generated command matches a broad ...[truncated 1030 chars]
• Remediation: ## Remediation Suggestions 1. Remove local development permission settings from the distributed Skill package. 2. Delete broad rules such as `Bash(chmod:*)` and `Bash(echo:*)` unless they are strictly required. 3. Authorize only the packaged `falcon.sh` script through its resolved project-relative or verified installation path. 4. Define separate, narrowly scoped rules for required read-only subcommands rather than allowing the entire command prefix. 5. Keep every write and engagement command behind an explicit user-confirmation boundary. 6. Ensure the permission engine rejects shell operators, command substitutions, redirections, and argument patterns outside the expected command grammar. 7. Do not authorize executables outside the reviewed project unless their path, ownership, permissions, and integrity are independently verified.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill description emphasizes search/read interaction, but the documented behavior includes high-impact state-changing actions such as posting, replying, liking, retweeting, bookmarking, and following accounts using authentication material. This mismatch can mislead operators, reviewers, or calling agents into treating the skill as low-risk read-only functionality when it can perform public or account-modifying actions.

Chaining Abuse

High

• Category: Tool Misuse

Content

# ---------------------------------------------------------------------------

_tmp_files=()
_cleanup() { [[ ${#_tmp_files[@]} -gt 0 ]] && rm -f "${_tmp_files[@]}" || true; }
trap _cleanup EXIT

_mktemp() {

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The script sends the full TWITTER_COOKIE value to api.twexapi.io in JSON bodies for write operations, effectively delegating account control to a third-party service. This is highly sensitive authentication material, and transmitting it off-platform without an explicit warning, consent flow, or minimization exposes the user to account takeover, session theft, or misuse if the API provider, logs, or network path are compromised.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill exposes shell-based command execution via `command-tool: Bash` and `command-arg-mode: raw` but does not declare any tool scope restrictions such as `permissions` or `allowed-tools`. This weakens policy enforcement and increases the chance that an agent can invoke broader shell capabilities than reviewers or users expect, especially if the backing script later grows beyond simple API calls.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

_mktemp() {
  local f
  f=$(mktemp)
  chmod 600 "$f"
  _tmp_files+=("$f")
  echo "$f"
}

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

printf 'Authorization: Bearer %s\n' "$TWEXAPI_KEY" > "$hdr_file"
  printf 'Content-Type: application/json\n' >> "$hdr_file"
  printf '%s' "$body" > "$body_file"
  curl -sS --fail-with-body \
    -X POST \
    -H @"$hdr_file" \
    -d @"$body_file" \

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

printf 'Authorization: Bearer %s\n' "$TWEXAPI_KEY" > "$hdr_file"
  printf 'Content-Type: application/json\n' >> "$hdr_file"
  printf '%s' "$body" > "$body_file"
  curl -sS --fail-with-body \
    -X DELETE \
    -H @"$hdr_file" \
    -d @"$body_file" \

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The write-capable commands immediately perform irreversible or account-affecting actions such as tweeting, following, liking, and retweeting with no confirmation step, dry-run mode, or prominent runtime warning. In an agent/skill context, this materially increases the chance of accidental or prompt-induced actions against a real social account.

Static analysis

No suspicious patterns detected.