Grok Twitter Query

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:31 AM UTC
• Version: 1.0.0

Overview

This skill is a small Grok query wrapper, but it sends prompts and a bearer API key to an opaque third-party endpoint without enough disclosure or endpoint safeguards.

Review before installing. Use only a narrowly scoped, revocable API key, avoid sensitive prompts, and change or remove the default endpoint unless you trust api.cheaprouter.club to receive both the bearer token and all submitted prompt text. Prefer a version that uses a clearly identified official or organization-approved endpoint with host allowlisting and explicit privacy disclosure.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/query_grok.py:7

Finding

Third-Party API Endpoint Receives Bearer Credentials and User Prompts

Content

View full analysis

Vulnerability Details

File Location: scripts/query_grok.py:7-8, 18-19, 28
Vulnerability Type: Transmission of credentials and potentially sensitive prompts to a third-party service
Risk Level: High

Vulnerable Code

python

API_URL = os.getenv("GROK_API_URL", "https://api.cheaprouter.club/v1/chat/completions")
API_KEY = os.getenv("GROK_API_KEY")

python

headers = {
    "Authorization": f"Bearer {API_KEY}",
    "Content-Type": "application/json"
}

python

response = requests.post(API_URL, headers=headers, json=payload)

The third-party endpoint is also presented in SKILL.md:13:

bash

export GROK_API_URL="https://api.cheaprouter.club/v1/chat/completions"  # optional

Technical Analysis

The script defaults to api.cheaprouter.club, which is not identified as an official xAI/Grok endpoint. Every request sends the value stored in GROK_API_KEY as a bearer credential and includes the complete user prompt in the JSON body.

Although the destination is visible in the documentation and code, the skill is presented as a Grok integration and the environment variable is named GROK_API_KEY. This creates a trust-boundary ambiguity: users may reasonably infer that they are supplying a credential directly to the official provider when the default recipient is instead a third-party routing service.

The endpoint can also be overridden without validation through GROK_API_URL. Consequently, a configuration error or manipulation of the process environment can redirect credentials and prompts to any HTTPS or HTTP destination accepted by the requests library. The script imposes no endpoint allowlist or transport-scheme validation.

Attack Path

1. A user follows SKILL.md and assigns an API credential to GROK_API_KEY.
2. The user runs the script without overriding GROK_API_URL, or an attacker influences that environment variable.
3. The script places the credential in the Authorization: Bearer header.
4. The s ...[truncated 1015 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the default URL with the official xAI/Grok API endpoint appropriate for the documented integration.
2. If a proxy is intentionally required, clearly identify its operator and explicitly warn that it receives both credentials and prompt content.
3. Use a provider-specific credential variable when a proxy-issued token is expected; do not imply that users should send an official provider key to an unrelated service.
4. Validate GROK_API_URL before use:
   • Require HTTPS.
   • Reject embedded credentials and unexpected ports.
   • Enforce an explicit allowlist of approved hostnames.
   • Disable redirects or verify the destination after every redirect.
5. Recommend narrowly scoped, revocable credentials with spending and rate limits.
6. Avoid submitting secrets or sensitive personal data in prompts, and document the external data-processing boundary.
7. Add a bounded request timeout and structured handling for network, HTTP, and JSON parsing failures.
8. Consider requiring explicit endpoint configuration rather than silently selecting a third-party default.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tainted flow: 'API_URL' from os.getenv (line 7, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 93% confidence

Finding

The request destination is taken from an environment variable and used directly in requests.post while also attaching the bearer API key and user prompt. If an attacker or untrusted deployment config sets GROK_API_URL to a malicious endpoint, the script will exfiltrate prompts and credentials to that server, making this an SSRF-style/exfiltration risk rather than a harmless configuration choice.

Content

Scanner excerpt · scripts/query_grok.py (reported line 28)May include surrounding context.

python

"temperature": 0.7
    }
    
    response = requests.post(API_URL, headers=headers, json=payload)
    response.raise_for_status()
    
    result = response.json()

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is presented as a Twitter/X summarization tool, but the documented behavior is just sending arbitrary prompts to a generic external chat-completions endpoint. That mismatch can mislead users and orchestrators into routing broader or more sensitive requests through a third-party service under the false assumption that it is a narrow Twitter-specific integration.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares capabilities that involve environment variables and outbound network access, but it does not define an explicit tool scope such as permissions or allowed-tools. This creates an unnecessary trust gap: operators and calling systems cannot easily tell that the skill may access secrets and transmit user prompts externally.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The activation criteria are broad enough to trigger on many ordinary requests about Twitter/X information, increasing the chance that user content is sent to the external provider even when a narrower or local capability would suffice. In context, that broad matching raises the risk of unnecessary data exposure and accidental overuse of an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation shows configuration for an API key and external endpoint, but it does not clearly warn that user prompts may be transmitted to a third-party API. Users may therefore provide sensitive or proprietary information without realizing it will leave the local environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The skill defaults to an external transmission endpoint at api.cheaprouter.club, which is unrelated to an official Twitter/X interface and may proxy or log submitted data. Because the skill accepts arbitrary prompts, sensitive user content and API credentials may be exposed to an untrusted third party if operators adopt the default configuration.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

bash

export GROK_API_KEY="your-api-key-here"
export GROK_API_URL="https://api.cheaprouter.club/v1/chat/completions"  # optional
export GROK_MODEL="grok-4.20-beta"  # optional

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 81% confidence

Finding

The default endpoint is a third-party domain unrelated to the named vendor and is embedded as the fallback destination for all prompts and API credentials. In the context of a skill advertised for Twitter/X summarization, using an opaque intermediary domain increases supply-chain and privacy risk because sensitive inputs may be routed to an unverified service.

Content

Scanner excerpt · scripts/query_grok.py (reported line 7)May include surrounding context.

python

import requests
import os

API_URL = os.getenv("GROK_API_URL", "https://api.cheaprouter.club/v1/chat/completions")
API_KEY = os.getenv("GROK_API_KEY")
MODEL = os.getenv("GROK_MODEL", "grok-4.20-beta")

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description claims Twitter/X querying and summarization, but the implementation is a generic single-prompt relay to any Grok-compatible chat endpoint. This capability mismatch is dangerous because operators or users may trust the skill with Twitter-scoped data handling while the code actually enables broader arbitrary external LLM use and data transmission.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The code accepts arbitrary prompt content and sends it to a configurable external API, which exceeds the stated narrow purpose of summarizing Twitter/X information. That broader-than-declared behavior increases the chance of sensitive data being sent off-platform under misleading expectations about the tool's scope.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/query_grok.py (reported line 28)May include surrounding context.

python

"temperature": 0.7
    }
    
    response = requests.post(API_URL, headers=headers, json=payload)
    response.raise_for_status()
    
    result = response.json()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script transmits the full user prompt to an external API without any built-in disclosure, consent mechanism, or warning in the user-facing flow. In an agent skill context, this can lead to unintentional leakage of sensitive user inputs because users may assume processing is local or platform-native.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script emits error/help text in Chinese only, which imposes a specific language on users without opt-in or an apparent region-specific justification. This is a natural-language policy concern because the file does not offer an alternative locale or document the restriction.

Content

No source excerpt is available for this finding.