T08 · Insecure Dependencies
Error
- Location
SKILL.md:78- Finding
Unpinned Third-Party CLI Is Downloaded and Executed at Runtime
- Content
View full analysis
- Remediation
View remediation
Security audit
Vincent - Twitter
Security checks for vulnerabilities and agentic risk
Overview
The skill provides Twitter/X lookups, but it also enables broad credential use, mutable CLI execution, and autonomous wallet-funded credit purchases.
Review this carefully before installing. It is not just a Twitter/X lookup helper: it can create and persist a Vincent DATA_SOURCES key, run a mutable npm CLI, make paid API calls, and buy credits through a wallet flow. Only use it with explicit spending controls, a low-balance dedicated wallet if payments are enabled, pinned CLI versions, and clear user approval before any top-up.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:183- Finding
Autonomous Credit Replenishment Grants Financial Privileges Beyond Twitter Data Retrieval
- Content
View full analysis
--amount 10 ``` The Skill further provides the following automatic replenishment pattern at lines 224-233: ```bash BALANCE=$(npx @vincentai/cli@latest credits balance --key-id --json | jq -r '.balance') if (( $(echo "$BALANCE < 2.00" | bc -l) )); then npx @vincentai/cli@latest credits add --key-id --amount 10 fi ``` ### Technical Analysis The declared purpose of the Skill is to search tweets, retrieve tweets, and look up Twitter/X profiles. Read-only data retrieval requires authenticated API access and the ability to consume an existing credit balance, but it does not inherently require unrestricted access to an agent wallet or autonomous authority to sign blockchain payments. The Skill explicitly enables payment without human intervention and recommends an automatic replenishment pattern. The documented flow does not impose: - Per-transaction human confirmation. - A cumulative session or daily spending ceiling. - A maximum number of replenishment operations. - A mandatory pause after replenishment. - Separation between data-access authority and wallet-signing authority. - Protection against repeated execution caused by loops, retries, or manipulated agent instructions. Although the example replenishes $10 at a time, the condition can become true repeatedly as credits are consumed. Consequently, the example's apparent transaction amount is not an effective cumulative spending limit. ### Attack Path 1. The agent is provided with, or alrea ...[truncated 1465 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (19)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Autonomous wallet-based credit purchasing is a high-risk capability unrelated to the core purpose of searching tweets or viewing profiles. If invoked by an agent without deliberate user approval, it can directly spend funds, and the skill text normalizes this behavior by framing it as routine operational support for data access.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The line explicitly states that credits can be purchased autonomously with no human intervention required, which is inappropriate for a Twitter data access skill. This encourages agents to spend funds without explicit user opt-in, turning a data retrieval tool into a self-funding payment actor.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The auto-replenish example provides concrete instructions for automatically purchasing credits when the balance falls below a threshold. In practice, this creates a ready-made pattern for recurring autonomous spending without explicit transactional consent, which is especially dangerous because the surrounding skill is framed as a simple Twitter lookup capability.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad enough that the skill may activate in ordinary conversation whenever terms like 'twitter' or 'look up user' appear, even when the user has not asked to invoke an external paid integration. In the context of a pay-per-call skill with credential creation and billing features, overbroad activation materially increases the risk of unintended tool use and unexpected charges.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill is presented as a Twitter/X data retrieval integration, but it also exposes and documents payment, checkout, and autonomous credit-purchase workflows. That materially expands the skill's authority from read-oriented data access into financial operations, increasing the chance an agent triggers paid actions the user did not expect from a Twitter lookup skill.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The card checkout flow exceeds the justified scope of a Twitter data access skill because it introduces a billing workflow into what users would reasonably expect to be a read-only integration. Even though it returns a URL rather than directly charging a card, it still enables financial workflow initiation and broadens the attack surface for deceptive or unnecessary payment prompts.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The security model states 'No environment variables are required,' yet the declared config path uses
${OPENCLAW_STATE_DIR:-$HOME/.openclaw}for credential storage resolution. While this may be optional rather than mandatory, the documentation actively suggests env vars are irrelevant even though runtime path behavior depends on them when present.- Content
Static analysis
No suspicious patterns detected.