ClawHub
Back to skill

Security audit

xAPI

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate xapi CLI gateway, but it gives agents broad external API, posting, OAuth, credential, and payment-related powers without enough explicit user-control boundaries.

Install only if you trust xapi.to and the `xapi-to` npx package. Treat this as a broad external API gateway, not a read-only lookup tool: do not send secrets or confidential content, protect the stored API key, and require explicit human approval before OAuth binding, posting or other POST/PUT/PATCH/DELETE calls, or any balance/top-up/payment flow.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill documentation expands from passive data access into account registration, persistent credential setup, and operational account management. That increases the permission and state-changing surface beyond the user-facing description, which can lead an agent to create accounts or modify long-lived auth state without clear user intent.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The skill claims lookup and AI-processing functionality, but it also documents write-capable third-party operations such as POST requests to Twitter/X endpoints. An agent may therefore invoke account-affecting actions like posting content while the skill appears read-oriented, creating a risk of unauthorized external actions.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill is framed around a few example domains, but it also supports discovery and invocation of broadly scoped third-party APIs. That mismatch can cause overbroad delegation, where an agent uses external services or endpoints the user did not reasonably expect from the skill description.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
Billing and top-up commands introduce financial side effects that are unrelated to a normal data lookup skill. If exposed to an agent without strict approval gates, they could trigger unauthorized spending or leak payment URLs containing sensitive account identifiers.

Vague Triggers

High
Confidence
96% confidence
Finding
The trigger language is extremely broad, including ordinary requests like search, summarize, rewrite, embeddings, or 'any third-party API,' plus activation when the user merely mentions xapi. This increases the chance of unnecessary tool use, data exfiltration to external services, and accidental invocation of sensitive capabilities.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill encourages transmitting user-provided prompts, search queries, and text to external services but does not clearly warn that third parties will receive that content. This creates privacy and compliance risk, especially for sensitive or proprietary user data.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation includes OAuth binding and write-capable Twitter operations without a strong warning about account-affecting actions. This can normalize posting or modifying external account state as part of routine workflow, increasing the risk of unauthorized actions on a user's linked account.

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: xapi
description: Use xapi CLI to access real-time external data — Twitter/X profiles, tweets, and timelines, crypto token prices and metadata, web search, news, and AI text processing (summarize, rewrite, chat, embeddings). Trigger this skill whenever the user wants to look up a Twitter user, get tweet details, check crypto prices, search the web or news, generate embeddings, summarize or rewrite text, or call any third-party API through xapi. Also use this skill when the user mentions xapi, asks about available capabilities or APIs, or wants to discover what external services are accessible.
homepage: https://xapi.to
metadata: {"openclaw":{"emoji":"x","requires":{"anyBins":["npx"]},"primaryEnv":"XAPI_API_KEY"}}
---
Confidence
88% confidence
Finding
write text, or call any third-party API through xapi. Also use this skill when the user mentions xapi, asks about available capabilities or APIs, or wants to discover what external services are access

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.