ClawHub
Back to skill

Security audit

twitter

Security checks for vulnerabilities and agentic risk

Overview

This skill needs Review because it can send X/Twitter login, 2FA, proxy credentials, and public account actions through a third-party API with limited safeguards described.

Install only if you are comfortable giving the SkillBoss/aisa.one service sensitive X/Twitter account credentials and allowing it to perform public actions such as posting, liking, and retweeting. Prefer a read-only setup, avoid entering passwords or TOTP codes on the command line, use a dedicated low-risk account if testing, and rotate any Twitter or proxy credentials already submitted through this workflow.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Error
Location
scripts/twitter_client.py:126
Finding

Twitter Account and Proxy Credentials Transmitted to a Third-Party Service

Content
View full analysis

Vulnerability Details

File Location: scripts/twitter_client.py, lines 126-139
Vulnerability Type: Credential disclosure to a third-party intermediary
Risk Level: Critical

Vulnerable Code

python
def login(self, username: str, email: str, password: str, proxy: str, totp_code: str = None) -> Dict[str, Any]:
    """Login to Twitter account."""
    data = {
        "user_name": username,
        "email": email,
        "password": password,
        "proxy": proxy
    }
    if totp_code:
        data["totp_code"] = totp_code
    return self._request("POST", "/twitter/user_login_v3", data=data)

The destination is statically configured as follows:

python
BASE_URL = "https://api.aisa.one/apis/v1"

Technical Analysis

The login method collects a Twitter/X username, email address, reusable password, proxy URL, and optional TOTP code, and sends all of them to the /twitter/user_login_v3 endpoint operated through api.aisa.one. A proxy URL may itself contain reusable credentials in the form http://user:password@host:port.

TLS protects the request while in transit, but it does not protect these secrets from the receiving third-party service, its operators, server-side logs, or an attacker who compromises that service. The intermediary receives enough authentication material to attempt direct account access and enough proxy information to reuse the user's proxy service.

Although account login is documented as part of the Skill, disclosure of reusable passwords and MFA codes to an intermediary exceeds the minimum privilege required for Twitter automation. A delegated authorization mechanism with narrow, revocable scopes would provide posting functionality without disclosing the account password.

Attack Path

  1. A user or autonomous agent invokes the login command with Twitter/X account credentials.
  2. The CLI passes the username, email, password, proxy URL, and opti ...[truncated 1437 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove password-based Twitter/X login through the third-party API.
  2. Integrate with Twitter/X's official OAuth authorization flow and use narrowly scoped, revocable access tokens.
  3. Request only the scopes required for the selected operation. Separate read-only access from posting and engagement permissions.
  4. Never transmit account passwords, TOTP values, recovery codes, or credential-bearing proxy URLs to an intermediary.
  5. Store delegated tokens in an operating-system credential store or another permission-restricted secret manager.
  6. Provide explicit consent and destination disclosure before any account data is transmitted.
  7. Ensure server and client logs redact authorization headers, tokens, proxy credentials, and authentication payloads.
  8. Rotate any Twitter/X passwords and proxy credentials previously submitted through this login mechanism, and review affected accounts for unauthorized activity.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/twitter_client.py:220
Finding

Sensitive Authentication Values Accepted Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/twitter_client.py, lines 220-225
Vulnerability Type: Insecure command-line secret handling
Risk Level: High

Vulnerable Code

python
# login
login = subparsers.add_parser("login", help="Login to Twitter account")
login.add_argument("--username", "-u", required=True, help="Twitter username")
login.add_argument("--email", "-e", required=True, help="Account email")
login.add_argument("--password", "-p", required=True, help="Account password")
login.add_argument("--proxy", required=True, help="Proxy URL")
login.add_argument("--totp", help="TOTP 2FA code")

Technical Analysis

The login interface requires or permits sensitive values to be supplied directly in the command line. These include the Twitter/X password, a TOTP code, and a proxy URL that may embed a proxy username and password.

Command-line arguments are not a secure secret channel. Depending on the operating system, shell, automation framework, and monitoring configuration, they may be exposed through:

  • Shell command history.
  • Process inspection utilities and process metadata.
  • Audit, telemetry, or endpoint-monitoring logs.
  • CI/CD output and agent execution traces.
  • Terminal recording and support diagnostics.
  • Wrapper scripts or orchestration systems that retain invocation parameters.

TOTP codes are short-lived, but disclosure during their validity window may assist an active login attempt. Passwords and proxy credentials generally remain reusable until rotated.

Attack Path

  1. A user follows the documented login workflow and supplies --password, --totp, or a credential-bearing --proxy value.
  2. The shell or execution environment records the complete command in history, telemetry, or an agent trace, or exposes it in process metadata while the command is running.
  3. A local user, administrator, monitoring-system operator, or attacker with access to retained l ...[truncated 776 chars]
Remediation
View remediation

Remediation Suggestions

  1. Eliminate password and TOTP collection by adopting an official OAuth authorization flow.
  2. Do not accept passwords, TOTP codes, access tokens, or credential-bearing proxy URLs as command-line arguments.
  3. If legacy password handling cannot immediately be removed, collect the password using getpass.getpass() so it is not echoed or placed in shell history.
  4. Obtain TOTP values through hidden interactive input or a permission-restricted secret provider rather than an argument.
  5. Read proxy credentials from a protected credential store and construct the proxy configuration in memory.
  6. Redact secrets from errors, debug messages, telemetry, and agent execution logs.
  7. Document that credentials previously entered on command lines should be removed from shell histories and relevant logs, then rotated.
  8. Prefer short-lived, operation-specific, revocable credentials over reusable account passwords.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (27)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared purpose emphasizes search/extract/post behavior, but the documented functionality extends to account login, follower/following enumeration, profile inspection, likes, retweets, and profile modification. This mismatch can mislead users and agents about the true action surface, increasing the risk of unexpected credential handling and unauthorized state-changing operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README explicitly advertises write-capable Twitter actions such as posting, liking, and retweeting, but it does not warn users that these operations can modify a real account, create public content, or trigger platform enforcement if misused by an autonomous agent. In an agent skill context, omission of account-impact warnings increases the chance that users enable high-impact actions without understanding the operational and reputational risks.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill uses sensitive capabilities (environment variable access and outbound network access) but does not declare an explicit tool scope such as permissions or allowed-tools. That weakens policy enforcement and user visibility, making it easier for an agent to invoke networked actions or handle secrets without clear sandbox constraints.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest frames the skill as search/extract/publish functionality, but the content also enables profile modification and engagement actions such as likes and retweets. That discrepancy can cause over-trust by agents or operators who would not expect broader account-manipulation features from the stated description.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
72% confidence
Finding

This skill sends requests and bearer-authenticated data to an external API endpoint. External transmission is expected for a Twitter integration, but it still creates a real data exposure boundary because prompts, identifiers, and API secrets leave the local agent environment and depend on the third party's trustworthiness and controls.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

bash
# Get user info
curl "https://api.aisa.one/apis/v1/twitter/user/info?userName=elonmusk" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

# Get user's latest tweets

External Transmission

Medium
Category
Data Exfiltration
Confidence
72% confidence
Finding

This skill sends requests and bearer-authenticated data to an external API endpoint. External transmission is expected for a Twitter integration, but it still creates a real data exposure boundary because prompts, identifiers, and API secrets leave the local agent environment and depend on the third party's trustworthiness and controls.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

bash
# Get user info
curl "https://api.aisa.one/apis/v1/twitter/user/info?userName=elonmusk" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

# Get user's latest tweets

External Transmission

Medium
Category
Data Exfiltration
Confidence
72% confidence
Finding

This endpoint transmits usernames and authorization headers to an external service to retrieve user tweet data. In context, outbound transmission is part of the advertised functionality, but it still matters because the skill lacks explicit domain scoping and routes activity through a non-Twitter third party.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md
-H "Authorization: Bearer $SKILLBOSS_API_KEY"

# Get user's latest tweets
curl "https://api.aisa.one/apis/v1/twitter/user/user_last_tweet?userName=elonmusk" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

# Advanced tweet search (queryType is required: Latest or Top)

External Transmission

Medium
Category
Data Exfiltration
Confidence
72% confidence
Finding

The advanced search request sends search terms and an API bearer token to an external provider. Search queries may contain sensitive business intelligence or user intent, so routing them through a third party without explicit scoping or privacy notes presents a data exposure risk.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
-H "Authorization: Bearer $SKILLBOSS_API_KEY"

# Advanced tweet search (queryType is required: Latest or Top)
curl "https://api.aisa.one/apis/v1/twitter/tweet/advanced_search?query=AI+agents&queryType=Latest" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

# Search top tweets

External Transmission

Medium
Category
Data Exfiltration
Confidence
71% confidence
Finding

This top-search endpoint continues the same pattern of sending authenticated requests and query data off-platform. While normal for a networked integration, the risk is that users may assume they are interacting directly with Twitter rather than an intermediary service that receives the data.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
-H "Authorization: Bearer $SKILLBOSS_API_KEY"

# Search top tweets
curl "https://api.aisa.one/apis/v1/twitter/tweet/advanced_search?query=AI+agents&queryType=Top" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

# Get trending topics (worldwide)

External Transmission

Medium
Category
Data Exfiltration
Confidence
69% confidence
Finding

Fetching public trend data from an external service is a relatively low-sensitivity transmission, but it still uses authenticated external network access. The main concern is unscoped egress and reliance on a third-party service rather than the public-data nature of the request itself.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md
-H "Authorization: Bearer $SKILLBOSS_API_KEY"

# Get trending topics (worldwide)
curl "https://api.aisa.one/apis/v1/twitter/trends?woeid=1" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

# Search users by keyword

External Transmission

Medium
Category
Data Exfiltration
Confidence
71% confidence
Finding

User-search requests can transmit potentially sensitive investigative or competitive-intelligence queries to an external provider. In the context of an autonomous social-listening skill, that can expose organizational interests or monitoring targets beyond what users may expect.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md
-H "Authorization: Bearer $SKILLBOSS_API_KEY"

# Search users by keyword
curl "https://api.aisa.one/apis/v1/twitter/user/search_user?keyword=AI+researcher" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

# Get tweets by ID

External Transmission

Medium
Category
Data Exfiltration
Confidence
69% confidence
Finding

Looking up tweets by ID is an external authenticated request, but the payload itself is generally low sensitivity when IDs are public. The risk remains primarily architectural: third-party dependence and transmission of metadata and API credentials without explicit scope declarations.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md
-H "Authorization: Bearer $SKILLBOSS_API_KEY"

# Get tweets by ID
curl "https://api.aisa.one/apis/v1/twitter/tweet/tweetById?tweet_ids=123456789" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

# Get user followers

External Transmission

Medium
Category
Data Exfiltration
Confidence
76% confidence
Finding

Followers enumeration transmits target account identifiers to an external service and enables collection of relationship graphs. In a social-intelligence context this expands surveillance capability, which is more sensitive than basic search and can be misused for profiling or targeting.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md
-H "Authorization: Bearer $SKILLBOSS_API_KEY"

# Get user followers
curl "https://api.aisa.one/apis/v1/twitter/user/user_followers?userName=elonmusk" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

# Get user followings

External Transmission

Medium
Category
Data Exfiltration
Confidence
76% confidence
Finding

Following enumeration similarly enables external collection of account relationship data through a third-party API. That broadens the skill from content search into social-graph intelligence, increasing privacy and misuse concerns beyond the headline description.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

-H "Authorization: Bearer $SKILLBOSS_API_KEY"

Get user followings

curl "https://api.aisa.one/apis/v1/twitter/user/user_followings?userName=elonmusk"
-H "Authorization: Bearer $SKILLBOSS_API_KEY"

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill instructs users to send Twitter login credentials and proxy details to a third-party API but does not provide a strong privacy/security warning, data-handling statement, or safer authentication alternative. This is dangerous because it normalizes transmission of highly sensitive credentials to an external service, creating credential theft, misuse, or account-compromise risk if the service or transport is abused.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
99% confidence
Finding

This request sends raw Twitter account credentials and proxy credentials to an external API service for login automation. That is highly dangerous because compromise, misuse, retention, or logging of those secrets could directly lead to account takeover, proxy credential exposure, and downstream abuse of the user's identity.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

bash
# Step 1: Login first (async, check status after)
curl -X POST "https://api.aisa.one/apis/v1/twitter/user_login_v3" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"user_name":"myaccount","email":"me@example.com","password":"xxx","proxy":"http://user:pass@ip:port"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Retrieving logged-in account details from a third-party API confirms and exposes account state through an external service. In combination with the login flow, this increases the amount of account metadata entrusted to the intermediary and supports full account lifecycle control.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md
-d '{"user_name":"myaccount","email":"me@example.com","password":"xxx","proxy":"http://user:pass@ip:port"}'

# Step 2: Check login status
curl "https://api.aisa.one/apis/v1/twitter/get_my_x_account_detail_v3?user_name=myaccount" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

# Send tweet

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

Posting tweets through a third-party API allows that intermediary to publish content as the user, creating direct integrity and reputational risk if requests are spoofed, mishandled, or issued unexpectedly by an autonomous agent. Because this is a state-changing action on a public account, the danger is materially higher than read-only API calls.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md
-H "Authorization: Bearer $SKILLBOSS_API_KEY"

# Send tweet
curl -X POST "https://api.aisa.one/apis/v1/twitter/send_tweet_v3" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"user_name":"myaccount","text":"Hello from OpenClaw!"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

Liking tweets via a third-party API creates state-changing social actions that can affect endorsements, engagement metrics, and account reputation. When embedded in an autonomous skill without narrow scoping, it raises the risk of unintended or manipulated interactions performed on the user's behalf.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md
-d '{"user_name":"myaccount","text":"Hello from OpenClaw!"}'

# Like a tweet
curl -X POST "https://api.aisa.one/apis/v1/twitter/like_tweet_v3" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"user_name":"myaccount","tweet_id":"1234567890"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

Retweeting is a public endorsement and redistribution action performed through a third-party service, so misuse can quickly amplify harmful or unauthorized content under the user's identity. In an autonomous context, this carries significant reputational and integrity risk even if the mechanism is functioning as designed.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md
-d '{"user_name":"myaccount","tweet_id":"1234567890"}'

# Retweet
curl -X POST "https://api.aisa.one/apis/v1/twitter/retweet_v3" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"user_name":"myaccount","tweet_id":"1234567890"}'

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Updating a Twitter profile is unrelated to the narrowly stated use case of search and posting, so its presence expands the skill into identity/account management without clear justification. Unnecessary state-changing features enlarge the attack surface and increase the chance of accidental or malicious account alteration.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

Updating profile name and bio through a third-party API gives the skill power to alter the user's account identity and public presentation. This is especially dangerous because profile modification is not central to the declared purpose, making unexpected identity changes more likely and harder for users to anticipate.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md
-d '{"user_name":"myaccount","tweet_id":"1234567890"}'

# Update profile
curl -X POST "https://api.aisa.one/apis/v1/twitter/update_profile_v3" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"user_name":"myaccount","name":"New Name","bio":"New bio"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/twitter_client.py (reported line 33)May include surrounding context.

python
class TwitterClient:
    """OpenClaw Twitter - Twitter/X API Client via SkillBoss API Hub."""
    
    BASE_URL = "https://api.aisa.one/apis/v1"
    
    def __init__(self, api_key: Optional[str] = None):
        """Initialize the client with an API key."""

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description emphasizes search and posting, but the code also accepts Twitter credentials, proxy settings, and optional 2FA codes, then sends them to a third-party API service for login and account access. That materially expands the trust boundary and privilege level of the skill, increasing the risk of credential misuse, account takeover, or unauthorized account-state access if users do not clearly understand what data is being delegated externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The login flow collects username, email, password, proxy, and optional TOTP code and transmits them to a remote service without any visible warning, consent checkpoint, or safer auth mechanism. In this skill context, that is especially dangerous because autonomous agents or users may assume they are interacting only with Twitter-related functionality, while in reality they are handing full account secrets to an external API hub.

Content

No source excerpt is available for this finding.