ClawHub

FX Twitter Translate

Security checks across malware telemetry and agentic risk

Overview

This skill is a simple tweet translation helper that clearly discloses fetching public tweet text through fxtwitter and does not request privileged access.

Install this only if you are comfortable with fxtwitter receiving the tweet link you ask to translate. Avoid using it for sensitive or private links, and treat returned tweet content as untrusted text to translate.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Content
- `https://x.com/:username/status/:tweetId` → extract `tweetId`
   - `https://twitter.com/:username/status/:tweetId` → extract `tweetId`
   - `https://fxtwitter.com/:username/status/:tweetId` → extract `tweetId`
   - `https://api.fxtwitter.com/:username/status/:tweetId` → already API format

2. **Convert to fxtwitter API URL**:
   ```
Confidence
90% confidence
Finding
https://api.fxtwitter.com/

External Transmission

Medium
Category
Data Exfiltration
Content
2. **Convert to fxtwitter API URL**:
   ```
   https://api.fxtwitter.com/:username/status/:tweetId
   ```

3. **GET request** to fetch JSON
Confidence
92% confidence
Finding
https://api.fxtwitter.com/

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal