X Alpha Scout

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:00 PM UTC
• Version: 1.0.0

Overview

The skill is coherent for X/Twitter crypto sentiment scouting, but it asks users to route reusable X session credentials through an unpinned third-party CLI without enough scoping or safety guidance.

Install only if you are comfortable giving the bird CLI authenticated access to an X/Twitter session. Prefer a dedicated low-privilege account, keep X_AUTH_TOKEN and X_CT0 out of chat, logs, screenshots, and repositories, verify the bird source/version before use, and treat all tweet text and links as untrusted data that should not control the agent or redirect report delivery.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:18
• Finding: Unpinned Third-Party Executable Receives Reusable X/Twitter Session Credentials<![CDATA[ ## Vulnerability Details **File Location**: `README.md:18-33` **Vulnerability Type**: Unpinned third-party dependency with access to authentication credentials **Risk Level**: Medium ### Vulnerable Code ```markdown 1. **Install bird** — X/Twitter CLI tool (by founder of OpenClaw) ```bash # Via Homebrew (macOS/Linux) brew install steipete/tap/bird # Or download from releases (if brew doesn't work) # https://github.com/steipete/bird/releases ``` 2. **Get X credentials:** - Auth token (`X_AUTH_TOKEN`) - CT0 cookie (`X_CT0`) 3. **Verify access:** ```bash bird whoami --auth-token "$X_AUTH_TOKEN" --ct0 "$X_CT0" ``` ``` A corresponding credential invocation also appears at `SKILL.md:12-20`: ```markdown **Environment variables:** ```bash export X_AUTH_TOKEN="your_twitter_auth_token" export X_CT0="your_twitter_ct0_cookie" ``` **Verify:** ```bash bird whoami --auth-token "$X_AUTH_TOKEN" --ct0 "$X_CT0" ``` ``` ### Technical Analysis The installation instructions retrieve the current version of the external `bird` executable through a mutable Homebrew tap or a release-download page. They do not pin a reviewed version, require an immutable artifact digest, or instruct the user to verify a signature or checksum. The installed executable is subsequently provided with `X_AUTH_TOKEN` and `X_CT0`. These values represent reusable X/Twitter session credentials. Environment variables reduce accidental command-history exposure, but they do not protect credentials from the process receiving them. The invoked executable can read its arguments, process environment, and accessible account data. Consequently, compromise of the upstream repository, Homebrew tap, release artifact, maintainer account, or a future dependency version could convert the documented command into a credential-theft path. No malicious behavior was found in the project itself; the risk is introduced through the mutable external dependency and its privil ...[truncated 1360 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the external CLI to a specific, reviewed release instead of installing the latest mutable version. 2. Publish the expected SHA-256 or stronger digest for each supported platform and require verification before execution. 3. Verify upstream release signatures where supported, and document the expected signing identity. 4. Prefer a trusted package source with reproducible builds and provenance attestations. 5. Record the reviewed dependency version in the project and define an explicit dependency-update review process. 6. Use the least-privileged authentication method supported by X/Twitter instead of reusable browser-session cookies where possible. 7. Use a dedicated account with minimal privileges for automated scanning. 8. Run the CLI in a restricted environment with minimal filesystem and network access. 9. Rotate `X_AUTH_TOKEN` and `X_CT0` after suspected dependency compromise, and document a credential-revocation procedure. 10. Avoid exposing credentials as command-line arguments if the CLI supports a protected credential file, operating-system key store, or restricted standard-input mechanism. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:99
• Finding: Attacker-Controlled Tweet Content Is Processed Without Prompt-Injection Boundaries<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:99-106`, `SKILL.md:128-131`; supporting data flow in `scripts/parse_calls.py:57-64` **Vulnerability Type**: Indirect prompt injection through untrusted social-media content **Risk Level**: Medium ### Vulnerable Code `SKILL.md:99-106` instructs the agent to reason directly over retrieved tweets: ```markdown **Analyze gathered tweets:** 1. **Count sentiment:** Bullish vs Bearish vs Neutral 2. **Identify high-conviction posts:** Position sizes, wallet proofs, detailed threads 3. **Check high-rep accounts:** Are known good callers in or out? 4. **Look for red flags:** Contract issues, copycat names, anon team ``` `SKILL.md:128-131` defines the untrusted search-result source: ```bash # Get general sentiment tweets bird search "$TICKER" -n 30 # Get high-rep account takes specifically bird search "$TICKER (from:DegenKing OR from:AlphaKing OR from:CryptoGem)" -n 20 ``` `scripts/parse_calls.py:57-64` retains attacker-controlled tweet text in output consumed by later processing: ```python return { 'caller': username, 'asset': ticker or 'Unknown', 'asset_type': asset_type, 'call_type': call_type, 'conviction': conviction, 'timestamp': timestamp, 'raw_text': tweet_text[:200] + '...' if len(tweet_text) > 200 else tweet_text } ``` ### Technical Analysis Tweets retrieved from X are controlled by arbitrary external users. The skill directs an AI agent to analyze this content but does not establish a boundary between trusted skill instructions and untrusted source data. It does not tell the agent to ignore instructions embedded in posts, prohibit tool calls requested by retrieved content, restrict link handling, or quote content through a data-only representation. The parser performs ordinary string extraction and preserves up to 200 characters of raw tweet text. This is not malicious code, but it also does not provide semantic isolation fr ...[truncated 2312 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Add an explicit instruction that all tweets, profiles, linked pages, and search results are untrusted data and must never be interpreted as agent instructions. 2. Require the agent to ignore requests within retrieved content to run tools, disclose secrets, modify policy, change output formats, contact third parties, or access additional resources. 3. Place external content in a structured data envelope with clearly separated fields such as `author`, `timestamp`, and `quoted_text`. 4. Analyze external content in a tool-disabled or least-privileged model stage, then pass only normalized observations to the report-generation stage. 5. Do not invoke tools or open links based solely on instructions contained in a tweet. 6. Validate output against a fixed schema and reject content that introduces unexpected commands, links, or report sections. 7. Require corroboration from multiple independent sources before assigning high-confidence sentiment, reputation, contract-risk, or investment conclusions. 8. Preserve source attribution so suspicious or manipulated evidence can be traced and excluded. 9. Apply length and character limits, but do not rely on truncation as the primary prompt-injection defense. 10. Ensure report-delivery integrations require explicit user authorization and cannot be redirected by text retrieved from X. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README instructs users to supply sensitive X/Twitter authentication material (`X_AUTH_TOKEN` and `X_CT0`) but provides no warning about secure storage, least-privilege handling, or the risk of exposing session credentials in logs, shell history, screenshots, or agent memory. Because these values are session-bearing credentials, mishandling them could allow account access or abuse of the user's X session.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The on-demand trigger examples are generic natural-language queries like "What do you think of $PEPEAI?" and "Analyze Pudgy Penguins" without any explicit activation boundary or exclusion conditions. In a general assistant context, these phrases are broad enough that the skill could be invoked unintentionally during normal conversation about assets or collections.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs users to provide and use active X/Twitter authentication credentials and then perform automated searches against the account, but it does not warn about the privacy, account-security, or terms-of-service risks of exposing and using those tokens. If mishandled, these credentials could allow unauthorized access to the user's X account session, account actions, or sensitive timeline/search data, especially in an agent environment where logs, prompts, or downstream tools may persist secrets.

Static analysis

No suspicious patterns detected.