ClawHub
Back to skill

Security audit

Tweet Share Card

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate tweet-card purpose, but its screenshot helper can turn a crafted tweet URL into local AppleScript execution and may capture more browser content than intended.

Review this skill before installing. It is not clearly malicious, but only use it with trusted tweet URLs and a dedicated browser profile. Avoid running it on a normal logged-in Chrome window until the URL is strictly validated before browser navigation, AppleScript input is safely passed or escaped, and uncropped intermediate screenshots are deleted automatically.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/capture_visible_tweet.py:11
Finding

AppleScript Injection Through an Unescaped URL Argument

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/capture_visible_tweet.py:20
Finding

Arbitrary Browser Navigation Due to Post-Navigation Substring Validation

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/capture_visible_tweet.py:15
Finding

Overbroad Browser Capture and Persistent Storage of Uncropped Private Content

Content
View full analysis
/.window.png ``` After creating the cropped output, the script does not delete this raw file. The uncropped screenshot can therefore persist beyond the skill invocation and may include browser chrome, account inf ...[truncated 1422 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

The script interpolates the untrusted tweet_url directly into AppleScript source and executes it via osascript. Because AppleScript string literals can be broken by crafted input, an attacker can inject additional AppleScript commands, potentially controlling local applications or executing shell commands through AppleScript on the host.

Content

Scanner excerpt · scripts/capture_visible_tweet.py (reported line 28)May include surrounding context.

python
return u & "\n" & ((item 1 of b as text) & "," & (item 2 of b as text) & "," & (item 3 of b as text) & "," & (item 4 of b as text))
end tell
'''
res = subprocess.check_output(['osascript', '-e', script]).decode().splitlines()
current_url = res[0].strip()
if 'x.com/' not in current_url and 'twitter.com/' not in current_url:
    raise SystemExit(f'Unexpected URL after navigation: {current_url}')

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/capture_visible_tweet.py (reported line 34)May include surrounding context.

python
raise SystemExit(f'Unexpected URL after navigation: {current_url}')
left, top, right, bottom = map(int, res[1].split(','))
raw = out.parent / (out.stem + '.window.png')
subprocess.check_call(['/usr/sbin/screencapture', '-x', '-R', f'{left},{top},{right-left},{bottom-top}', str(raw)])
img = Image.open(raw).convert('RGBA')
W, H = img.size
# Main tweet column crop for desktop X layout; conservative and left-column focused.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The README states that the skill reads tweet content and may include metrics from external X/Twitter links, but it does not disclose this data-fetching behavior as a user-facing warning or note about external content processing. This is primarily a transparency and privacy-consent issue: users may not realize the skill will retrieve and process remote post data and associated metadata.

Content

No source excerpt is available for this finding.