ClawHub
Back to skill

Security audit

xbird

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Twitter/X MCP integration, but it asks users to run mutable third-party code with live X session cookies and an optional wallet private key, which deserves Review before installation.

Install only if you are comfortable giving this MCP process control over a live X session and, for paid use, wallet signing capability. Prefer a dedicated low-value wallet, avoid storing secrets in shared plaintext configs, revoke the X session if exposed, pin and review the npm package before use, and require manual confirmation for posts, follows, profile changes, media uploads, and paid calls.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:12
Finding

Unpinned Third-Party Package Is Downloaded and Executed Through npx

Content
View full analysis
Remediation
View remediation
``` 2. Verify the pinned package using an integrity hash and a committed lockfile. 3. Publish or link to reproducible source code and document how the distributed npm artifact corresponds to that source. 4. Verify the package publisher and signing provenance before installation. 5. Disable lifecycle scripts where practical and review all installation and runtime scripts before execution. 6. Run the MCP server in a sandbox or isolated operating-system account with restricted filesystem and network access. 7. Establish a controlled update process in which new versions are reviewed before deployment rather than automatically consumed. 8. Restrict the MCP process to only the credentials and filesystem resources necessary for its operation. ]]>

other

Error
Location
SKILL.md:16
Finding

Reusable X Session Credentials and a Wallet Private Key Are Exposed to a Third-Party MCP Process

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
97% confidence
Finding

The skill explicitly directs users to place authentication cookies and a wallet private key in the agent configuration directory, a high-value target commonly accessible to local tools, plugins, or compromised code running in the same environment. Given this skill also recommends executing a remotely fetched MCP server, compromise of that environment could expose Twitter session credentials and payment keys, enabling account takeover and financial abuse.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

claude mcp add xbird -- npx @checkra1n/xbird

text

Required environment variables (set in `~/.claude/settings.json` or shell):
- `XBIRD_AUTH_TOKEN` — from x.com cookies (DevTools → Application → Cookies → `auth_token`)
- `XBIRD_CT0` — from x.com cookies (DevTools → Application → Cookies → `ct0`)
- `XBIRD_PRIVATE_KEY` — wallet private key for x402 payments (optional, needed for paid tier)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list is very broad and includes generic social-media terms, increasing the chance the skill is invoked in contexts the user did not intend. Because this skill includes account-reading and account-modifying actions, accidental invocation could lead to unintended access, posting, or social actions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs users to run an unpinned package directly via npx, which fetches and executes whatever version is current at invocation time. If the package is compromised, updated maliciously, or subject to dependency hijacking, the agent environment could execute attacker-controlled code with access to local credentials and configuration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation tells users to provide live session cookies and optionally a wallet private key, but does not include strong warnings about the sensitivity of those secrets or the consequences of account-modifying actions. In this context, missing safety guidance materially increases the risk of credential mishandling, unauthorized account use, and financial loss through metered calls.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.