ClawHub
Back to skill

Security audit

Edison Autopilot Post X

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent auto-posting tool, but it deserves review because it can repeatedly publish to a live X account and can send local Markdown scan content to OpenAI when SCAN_DIR is set.

Review carefully before installing. Use a dedicated X account and narrowly scoped API keys, run dry-run first, avoid enabling cron until outputs are acceptable, and do not set SCAN_DIR to any directory containing private or untrusted Markdown. If Telegram is enabled, assume tweet text and some failure details may be sent there.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
auto_tweet.py:98
Finding

Unrestricted Research Scan Content Is Transmitted to OpenAI and Can Influence Automated X Posts

Content
View full analysis
220 chars. - One idea per tweet. - Output ONLY the tweet text, nothing else. No quotes around it. VARIETY (critical — never repeat the same format): - Mix formats: bold claims, disagreements, questions, one-liners, mini-stories - Mix tone: funny, dead serious, provocative, vulnerable - NEVER start two tweets the same way. - BE BOLD. Safe tweets get zero engagement. """ resp = requests.post( ...[truncated 3500 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
README.md:21
Finding

Unpinned Third-Party Dependencies Create Supply-Chain and Reproducibility Risk

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (20)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical
Category
YARA Match
Confidence
85% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · auto_tweet.py (reported line 25)May include surrounding context.

python
# post a tweet
  4. python auto_tweet.py --dry-run # preview without posting

Cron example (5x daily at 8am, 11am, 2pm, 5pm, 9pm PST):
  0 8,11,14,17,21 * * * cd /path/to/repo && python auto_tweet.py
"""

import json
import os
import random
import sys
from datetime import datetime, timezone

import requests
import tweepy

# --- Config (set these as environment variables) ---
OPENAI_KEY = os.environ["OPENAI_API_KEY"]
X_CONSUMER_KEY = os.environ["X_CONSUMER_KEY"]
X_CONSUMER_SECRET = os.environ["X_CONSUMER_SECRET"]
X_ACCESS_TOKEN = os.environ["X_ACCESS_TOKEN"]
X_ACCESS_TOKEN_SECRET = os.environ["X_ACCESS_TOKEN_SECRET"]

# Optional: Telegram notifications
TG_BOT_TOKEN = os.environ.get("TWEET_BOT_TOKEN", "")
TG_CHAT_ID = os.environ.get("TWEET_BOT_CHAT_ID", "")

# Where to log posted tweets (for dedup)
LOG_DIR = os.path.expanduser("~/autopilot-post-x/logs")

# Optional: research scan directory for context-aware tweets
SCAN_DIR = os.environ.get("SCAN_DIR", "")

# --- Persona Prompt -

Tainted flow: 'OPENAI_KEY' from os.environ (line 25, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · auto_tweet.py (reported line 157)May include surrounding context.

python
- BE BOLD. Safe tweets get zero engagement.
"""

    resp = requests.post(
        "https://api.openai.com/v1/chat/completions",
        headers={"Authorization": f"Bearer {OPENAI_KEY}", "Content-Type": "application/json"},
        json={

Tainted flow: 'OPENAI_KEY' from os.environ (line 25, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · auto_tweet.py (reported line 175)May include surrounding context.

python
for _ in range(3):
        if len(text) <= 280:
            break
        resp = requests.post(
            "https://api.openai.com/v1/chat/completions",
            headers={"Authorization": f"Bearer {OPENAI_KEY}", "Content-Type": "application/json"},
            json={

Tainted flow: 'TG_BOT_TOKEN' from os.environ.get (line 32, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · auto_tweet.py (reported line 238)May include surrounding context.

python
f"Error: {error_msg}"
        )
    try:
        requests.post(
            f"https://api.telegram.org/bot{TG_BOT_TOKEN}/sendMessage",
            data={"chat_id": TG_CHAT_ID, "text": msg, "disable_web_page_preview": True},
            timeout=10,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README clearly promotes fully automated posting to a real X account and optional Telegram notifications, but it does not prominently warn that running the tool will transmit generated content and metadata to external services and can perform irreversible real-account actions. This creates a meaningful safety and operational risk because users may test or schedule it without appreciating that it can post publicly and send notifications off-host.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 62)May include surrounding context.

6. Schedule with cron

bash
crontab -e

Add (5x daily at 8am, 11am, 2pm, 5pm, 9pm):

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill explicitly instructs users to run a script that will post to a live X account, but it does not prominently warn that this causes real external actions, may consume paid API quota, and may damage the user's account reputation if misconfigured. In an agent-skill context, missing safety framing around irreversible network actions increases the chance of unintended posting or misuse.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

The cron instruction creates persistent automated execution, causing repeated external posting without per-run user review. In a skill that publishes content to a public platform, this persistence amplifies the impact of prompt mistakes, compromised dependencies, or later code changes because actions continue unattended.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

5. Schedule with cron (5x daily)

bash
crontab -e
# Add: 0 8,11,14,17,21 * * * cd /path/to/repo && python auto_tweet.py

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

Telegram notification capability adds a second outbound communication channel unrelated to the core requirement of generating and posting tweets. Extra channels increase the chance of silent data leakage, especially because this code sends tweet content and exception details off-platform.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill reads arbitrary markdown files from a configurable local directory and injects their contents into prompts sent to OpenAI. If SCAN_DIR points to sensitive reports or internal documents, the script can disclose local proprietary or confidential data to a third-party API without validation or consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The natural-language instruction 'Always in English' imposes a fixed language policy on generated content. For a general-purpose auto-posting skill, this is a locale/language restriction without user choice or an explicit region-specific justification, which matches the policy-violation criteria.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This duplicate external-transmission finding corresponds to the same primary OpenAI request. In context, it is dangerous because local context from SCAN_DIR and recent logs can be exported to a third party without strong boundary controls.

Content

Scanner excerpt · auto_tweet.py (reported line 157)May include surrounding context.

python
- BE BOLD. Safe tweets get zero engagement.
"""

    resp = requests.post(
        "https://api.openai.com/v1/chat/completions",
        headers={"Authorization": f"Bearer {OPENAI_KEY}", "Content-Type": "application/json"},
        json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This duplicate external-transmission finding corresponds to the same primary OpenAI request. In context, it is dangerous because local context from SCAN_DIR and recent logs can be exported to a third party without strong boundary controls.

Content

Scanner excerpt · auto_tweet.py (reported line 157)May include surrounding context.

python
- BE BOLD. Safe tweets get zero engagement.
"""

    resp = requests.post(
        "https://api.openai.com/v1/chat/completions",
        headers={"Authorization": f"Bearer {OPENAI_KEY}", "Content-Type": "application/json"},
        json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

Use of the OpenAI endpoint is an external data transfer to a third party. Given this script reads local scan files and recent tweet logs, the context makes the transfer materially sensitive unless the transmitted content is constrained and reviewed.

Content

Scanner excerpt · auto_tweet.py (reported line 158)May include surrounding context.

python
"""

    resp = requests.post(
        "https://api.openai.com/v1/chat/completions",
        headers={"Authorization": f"Bearer {OPENAI_KEY}", "Content-Type": "application/json"},
        json={
            "model": "gpt-5.1",

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This duplicate finding reflects the same shortening request to OpenAI. The concern is secondary exposure of already-ingested content, which matters if sensitive local information entered the first prompt or model output.

Content

Scanner excerpt · auto_tweet.py (reported line 175)May include surrounding context.

python
for _ in range(3):
        if len(text) <= 280:
            break
        resp = requests.post(
            "https://api.openai.com/v1/chat/completions",
            headers={"Authorization": f"Bearer {OPENAI_KEY}", "Content-Type": "application/json"},
            json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This duplicate finding reflects the same shortening request to OpenAI. The concern is secondary exposure of already-ingested content, which matters if sensitive local information entered the first prompt or model output.

Content

Scanner excerpt · auto_tweet.py (reported line 175)May include surrounding context.

python
for _ in range(3):
        if len(text) <= 280:
            break
        resp = requests.post(
            "https://api.openai.com/v1/chat/completions",
            headers={"Authorization": f"Bearer {OPENAI_KEY}", "Content-Type": "application/json"},
            json={

Tainted flow: 'text' from requests.post (line 187, network input) → requests.post (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · auto_tweet.py (reported line 175)May include surrounding context.

python
for _ in range(3):
        if len(text) <= 280:
            break
        resp = requests.post(
            "https://api.openai.com/v1/chat/completions",
            headers={"Authorization": f"Bearer {OPENAI_KEY}", "Content-Type": "application/json"},
            json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The shortening request is another external transmission to OpenAI. Its risk derives from repeated exposure of generated text that may encode sensitive prompt material from local sources.

Content

Scanner excerpt · auto_tweet.py (reported line 176)May include surrounding context.

python
if len(text) <= 280:
            break
        resp = requests.post(
            "https://api.openai.com/v1/chat/completions",
            headers={"Authorization": f"Bearer {OPENAI_KEY}", "Content-Type": "application/json"},
            json={
                "model": "gpt-5.1",

Tainted flow: 'msg' from requests.post (line 231, network input) → requests.post (network output)

Medium
Category
Data Flow
Confidence
86% confidence
Finding

The Telegram notification forwards tweet text and raw error messages to an external messaging service. Because error strings or generated content can include sensitive local or third-party data, this creates an unintended data disclosure channel outside the stated core tweet-posting function.

Content

Scanner excerpt · auto_tweet.py (reported line 238)May include surrounding context.

python
f"Error: {error_msg}"
        )
    try:
        requests.post(
            f"https://api.telegram.org/bot{TG_BOT_TOKEN}/sendMessage",
            data={"chat_id": TG_CHAT_ID, "text": msg, "disable_web_page_preview": True},
            timeout=10,

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

This Telegram request sends operational messages, tweet content, and raw failure details to a separate third-party service. In the context of an automation skill, that creates an unnecessary external disclosure path and broadens the blast radius of prompt leakage or exception-based secret exposure.

Content

Scanner excerpt · auto_tweet.py (reported line 239)May include surrounding context.

python
)
    try:
        requests.post(
            f"https://api.telegram.org/bot{TG_BOT_TOKEN}/sendMessage",
            data={"chat_id": TG_CHAT_ID, "text": msg, "disable_web_page_preview": True},
            timeout=10,
        )

Static analysis

No suspicious patterns detected.