ClawHub
Back to skill

Security audit

Twitter API

Security checks across malware telemetry and agentic risk

Overview

This is a read-only Twitter/X data access skill that clearly discloses its paid API calls and credential use.

Before installing, confirm you are comfortable sending Twitter/X queries to twitter.fetcher.sh and paying per API call. Store any Fetcher API key as a secret, avoid committing it or placing real keys in shared MCP configs, and set your own spending controls when polling or paginating large result sets.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
91% confidence
Finding
The skill includes example commands that use a live-style Bearer token format and instruct users to export and send that credential, but it does not warn against exposing, logging, or committing the key. In agent and automation contexts, such examples are often copied into shell history, shared notebooks, or repos, which can lead to credential leakage and unauthorized use of prepaid credits or associated account access.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/scenarios.md:11

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:78