Auto Tweet Publish

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:24 PM UTC
• Version: 1.0.0

Overview

This skill is a real X/Twitter automation server, but it exposes powerful account actions through an unauthenticated local API and stores account secrets in local files.

Review before installing. Only run this on a trusted machine, keep it bound to localhost, do not expose the port, and treat config.json and cookies.json like account passwords. Prefer adding API authentication, explicit confirmations for every account-changing action, media path restrictions, stricter secret-file permissions, and pinned dependencies before using it with a real X account.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: main.py:378

Finding

Unauthenticated API Permits Full Control of the Authenticated X Account

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: main.py:378

Finding

Caller-Controlled Media Paths Permit Access to Arbitrary Local Files

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: rate_limiter.py:22

Finding

Non-Atomic and Non-Persistent Rate Limiting Can Be Bypassed

Content

View full analysis

None: """Raise 429 if rate limit exceeded.""" check = limiter.check_tweet() if is_tweet else limiter.check_general() if not check["allowed"]: raise HTTPException( status_code=429, detail={ "error": "RATE_LIMIT_EXCEEDED", "message": "Rate limit exceeded. Slow down to protect your account.", **limiter.get_status(), }, ) ``` An awaited external operation occurs between the check and record: ```python @app.post("/tweet", tags=["Tweets"]) async def post_tweet(req: TweetRequest): """Post a new tweet.""" _check_rate(is_tweet=True) try: media_ids = None if req.media_paths: media_ids = [] for path in req.media_paths: mid = await client.upload_media(path, wait_for_completion=True) media_ids.append(mid) tweet = await client.create_tweet( text=req.text, media_ids=media_ids, reply_to=req.reply_to, attachment_url=req.quote_url, is_note_tweet=req.is_note_tweet, ) limiter.record_action(is_tweet=True) log.info("✅ Tweet posted: %s", tweet.id) return _tweet_to_dict(tweet) except Exception as e: _handle_twitter_error(e) ``` The limiter stores counters only in process memory: ```python def check_tweet(self) -> dict: """Check if posting a tweet is allowed.""" general = self.check_general() self._prune(self._tweet_window, 86400) tweet_remaining = self.tweet_per_day - len(self._tweet_window) allowed = general["allowed"] and tw ...[truncated 2321 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: main.py:242

Finding

Long-Lived X Credentials and Session Cookies Are Stored in Plaintext Files

Content

View full analysis

None: """Perform username/password login and save cookies.""" username = config.get("username", "") email = config.get("email") password = config.get("password", "") totp = config.get("totp_secret") if not username or not password: log.error("username and password required in config.json") sys.exit(1) log.info("Logging in as %s ...", username) # Clear stale cookies to avoid CookieConflict on .x.com/.twitter.com try: client.http.cookies.clear() except Exception: pass try: await client.login( auth_info_1=username, auth_info_2=email, password=password, totp_secret=totp, cookies_file=cookies_file, ) ``` The cookie path is constructed and loaded without a permission check: ```python cookies_file = str(BASE_DIR / config.get("cookies_file", "cookies.json")) force_login = "--login" in sys.argv async def _login_once_or_retry(): retry_delays = [300, 300, 600, 600, 1800, 1800, 3600] attempt = 0 while True: try: if os.path.exists(cookies_file) and not force_login: log.info("Loading saved cookies from %s" ...[truncated 1928 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unbounded Dependency Constraints Make Installations Non-Reproducible

Content

View full analysis

=2.3.1 fastapi>=0.109.0 uvicorn>=0.27.0 pydantic>=2.0.0 ``` ### Technical Analysis Every declared dependency uses a lower bound without an upper bound or exact pin. A future release of any package can therefore be selected during a fresh installation without having been reviewed with this project. This prevents reproducible builds and increases exposure to: - Compromised future package releases. - Unexpected breaking changes. - New vulnerable transitive dependencies. - Behavioral differences between installations. The code also optionally imports `curl_cffi` through `curl_httpx_shim.py`, but `curl_cffi` is not declared in `requirements.txt`. This creates an incomplete and environment-dependent dependency model. No evidence was found that the currently named packages are typosquatted or intentionally malicious. The confirmed issue is unsafe and incomplete dependency management rather than a confirmed compromised package. ### Attack Path 1. An administrator performs a fresh installation using `pip install -r requirements.txt`. 2. The package resolver selects the newest versions satisfying each `>=` constraint. 3. A future compromised, vulnerable, or incompatible release satisfies the constraint. 4. That release or one of its transitive dependencies is installed. 5. Package code executes during installation, import, or normal application operation with the privileges of the service account. ### Impact Assessment The possible impact depends on the behavior of the selected dependency release. In a supply-chain compromise, dependency code could receive the same process privileges as the application, including potential access to: - X credentials and session cookies. - Account data processed by the service. - Files readable by the service account. - Outbound netw ...[truncated 175 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose understates the full action surface: the skill can send DMs, read notifications, follow/unfollow, delete tweets, schedule posts, and query trends beyond the headline description. This mismatch is dangerous because users or orchestrators may invoke the skill under a narrower trust assumption while it actually has broader, account-affecting and privacy-impacting capabilities.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documentation claims 'Local API on localhost (no external access)' even though the service authenticates to and performs outbound operations against X/Twitter. This is misleading about network behavior and data egress, which can cause operators or users to expose credentials, messages, and account actions under false assumptions about isolation.

Content

No source excerpt is available for this finding.

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

• Category: Supply Chain
• Confidence: 70% confidence

Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises network and file-related behavior but does not declare an explicit tool scope or permission boundary. In an agent environment, this can cause overbroad invocation and make sensitive actions like account operations, cookie/config access, or outbound social-media actions occur without clear authorization constraints.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The invocation text is broad enough to match many common social-media requests, which can cause the skill to activate in situations where the user did not intend real account actions. In a high-privilege account-management skill, loose activation boundaries increase the risk of unintended posting, liking, follows, DMs, or deletion operations.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

Post a tweet

bash

curl -X POST http://localhost:19816/tweet \
  -H "Content-Type: application/json" \
  -d '{"text": "Hello from OpenClaw!"}'

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation presents the skill as tweet/account management but also exposes messaging, relationship management, scheduling, and notification-reading features. Hidden or underemphasized capabilities increase the chance of misuse, accidental invocation, or approval of actions the user did not realize were in scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill exposes destructive and account-affecting operations such as delete, DM, follow/unfollow, retweet, and scheduling without prominently warning that these actions can change account state or affect third parties. In an agent setting, lack of warning materially increases the chance of accidental harmful actions and weakens informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The config sets a fixed language value of "en-US", which is a natural-language locale constraint. In this file there is no indication that users can opt into a different language or that the English-only setting is required for a region-specific or compliance reason.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code performs outbound HTTP requests and manages session cookies, which can transmit user or system data, but the only disclosure is an internal log message about initialization. There is no confirmation prompt, user-facing print/log, or comment/docstring warning users that requests and associated cookies will be sent over the network.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill metadata says it should be used for tweeting, search, timeline, and account management, but the implementation also exposes direct-message sending. Undisclosed DM capability is security-relevant because it enables transmission of private content to an external platform under the user's authenticated account, which changes the trust boundary and can surprise downstream systems or users relying on the manifest.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The DM endpoint sends arbitrary text to another user over X/Twitter without any user-facing warning that private content is being transmitted to an external service. In this skill context, that is especially sensitive because DMs are perceived as private communications and may contain confidential information or be triggered by an agent on the user's behalf.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code implements follow/unfollow actions that are not specifically disclosed in the manifest. These are account-management operations with reputational and behavioral impact, and undisclosed support for them can cause users or orchestrators to grant broader trust than intended.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The security note at L205 asserts 'No telemetry, no external callbacks,' but the entire skill's purpose is to relay actions and data to Twitter/X through a local server that wraps twikit. While this may mean no vendor telemetry beyond intended Twitter/X traffic, the statement as written contradicts the actual behavior and could mislead users about network side effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The client language is taken from configuration with a default of en-US, causing the skill to operate in a specific locale when the user has not explicitly chosen one. This can violate language/locale policy because the default is imposed rather than selected through user opt-in or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The API supports scheduled tweeting but the manifest does not mention delayed posting. Hidden scheduling is risky because it allows actions to occur after the original interaction context has ended, increasing the chance of unintended or hard-to-audit account activity.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Notifications retrieval is implemented but omitted from the manifest. While lower impact than active posting, it still expands access to potentially sensitive account data and weakens informed consent about what the skill can read.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency specification for twikit uses a lower-bound only constraint, which allows future unreviewed versions to be installed. This weakens build reproducibility and can unintentionally pull in compromised or breaking releases through the package supply chain.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

twikit>=2.3.1
fastapi>=0.109.0
uvicorn>=0.27.0
pydantic>=2.0.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The FastAPI dependency is not pinned to an exact version, so installations may resolve to different releases over time. In a network-facing API skill, this increases exposure to newly introduced bugs or vulnerable versions and makes security posture hard to verify.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

twikit>=2.3.1
fastapi>=0.109.0
uvicorn>=0.27.0
pydantic>=2.0.0

Unverifiable Dependency: fastapi has 3 known advisory(ies) (CVE-2021-32677 (Cross-Site Request Forgery (CSRF) in FastAPI); CVE-2021-32677 (FastAPI is a web framework for building APIs with Python 3.6+ based on standard ); CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

FastAPI has known advisories, and because the manifest does not pin an exact version, it is impossible to verify whether the deployed package is affected. In a skill exposing a local API server, this uncertainty matters because framework vulnerabilities can affect request handling and trust boundaries.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The uvicorn dependency is specified with a minimum version only, allowing uncontrolled upgrades during installation. Because uvicorn is the HTTP server for the local API, an unexpected vulnerable or incompatible release could directly affect the service boundary.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

twikit>=2.3.1
fastapi>=0.109.0
uvicorn>=0.27.0
pydantic>=2.0.0

Unverifiable Dependency: uvicorn has 4 known advisory(ies) (CVE-2020-7694 (Log injection in uvicorn); CVE-2020-7695 (HTTP response splitting in uvicorn); CVE-2020-7694 (This affects all versions of package uvicorn. The request logger provided by the) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Uvicorn has published security advisories, but the current requirement does not identify the exact installed version. This prevents reliable assessment of whether the local HTTP server may be exposed to known issues such as log or protocol handling flaws.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The pydantic dependency is unpinned, which permits different environments to install different versions. Since pydantic typically handles input validation and parsing, an unexpected version may introduce parsing flaws, denial-of-service conditions, or behavior changes.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

twikit>=2.3.1
fastapi>=0.109.0
uvicorn>=0.27.0
pydantic>=2.0.0

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

Pydantic has known advisories, and an unpinned requirement means a vulnerable version could be installed without visibility. Because it is commonly used for request validation, a vulnerable release could enable denial of service or unsafe parsing behavior in the API stack.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.