ClawHub
Back to skill

Security audit

Omni-X

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it asks users and agents to handle live X/Twitter session credentials in ways that are too risky and under-scoped for routine installation.

Review carefully before installing. Avoid giving this skill a real primary-account X/Twitter auth_token, username, or password; prefer guest mode or a dedicated low-risk account, keep secrets in environment variables or a secret manager, avoid saved sessions, pin dependencies, and set strict limits on requested result counts.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned Third-Party Dependency Exposes Authentication Tokens to Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1, setup.py:33-35, references/INSTALLATION.md:18-21
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable code in requirements.txt:1:

text
tweeterpy

Vulnerable code in setup.py:33-35:

python
install_requires=[
    "tweeterpy",
],

Installation command in references/INSTALLATION.md:18-21:

bash
### Step 2: Install Dependencies
```bash
pip install -r requirements.txt
text

### Technical Analysis

The project installs `tweeterpy` without an exact version constraint, lock file, or package integrity hash. Consequently, installation resolves to whichever release is available from the configured Python package index at that time.

TweeterPy operates within the same Python process and receives the user's Twitter/X authentication token through `generate_session(auth_token=auth_token)`. Dependency code therefore has the same local privileges as the Skill and legitimate access to the supplied token and session state.

This does not establish that the current TweeterPy package is malicious. The vulnerability is that the reviewed Skill does not constrain the dependency to a specific, audited artifact. A compromised publisher account, malicious future release, package-index compromise, or hostile package served by a substituted index could change the effective code after this audit.

### Attack Path

1. An attacker compromises the upstream package, its publisher account, or the package source used by the victim.
2. The attacker publishes or serves a modified `tweeterpy` release.
3. A user follows the documented `pip install -r requirements.txt` or package installation procedure.
4. Pip resolves and installs the attacker-controlled release because no version or hash is enforced.
5. The user initializes `TwitterSkillInterface` with an authentication token.
6. The Skill passes t
...[truncated 830 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin TweeterPy to an exact, reviewed version in both dependency manifests:
    text
    tweeterpy==<reviewed-version>
  2. Generate a lock file that also constrains all transitive dependencies.
  3. Record and enforce package hashes:
    bash
    pip install --require-hashes -r requirements.txt
  4. Keep requirements.txt and setup.py synchronized so that neither installation path permits an unconstrained version.
  5. Review release notes and source changes before updating the pinned version.
  6. Run the Skill in an isolated virtual environment or container with minimal file and network privileges.
  7. Avoid installing dependencies as root or another privileged account.
  8. Use a controlled package mirror and automated dependency vulnerability monitoring.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/skill_interface.py:161
Finding

Unbounded Extraction Counts and Incomplete Request Throttling Permit Resource Exhaustion

Content
View full analysis

Vulnerability Details

File Location: scripts/skill_interface.py:161-216, scripts/twitter_skills.py:52-60, scripts/twitter_skills.py:86-108, scripts/twitter_skills.py:116-224
Vulnerability Type: Missing input validation and ineffective request limiting
Risk Level: Medium

Rate-limiting implementation in scripts/twitter_skills.py:52-60:

python
def _apply_rate_limit(self):
    """Apply rate limiting delay between requests."""
    current_time = time.time()
    time_since_last_request = current_time - self.last_request_time
    
    if time_since_last_request < self.rate_limit_delay:
        sleep_time = self.rate_limit_delay - time_since_last_request
        time.sleep(sleep_time)
    
    self.last_request_time = time.time()

Unvalidated parameter forwarding in scripts/skill_interface.py:161-216:

python
def execute_skill(self, skill_name: str, parameters: Dict[str, Any]) -> Dict[str, Any]:
    """
    Execute a skill by name with given parameters.
    
    Args:
        skill_name: Name of the skill to execute
        parameters: Dictionary of parameters for the skill
        
    Returns:
        Standardized response with success status, data, and metadata
    """
    if skill_name not in self.available_skills:
        return {
            "success": False,
            "error": f"Unknown skill: {skill_name}",
            "available_skills": list(self.available_skills.keys())
        }
    
    try:
        # Route to appropriate skill method
        if skill_name == "get_user_profile":
            result = self.skills.get_user_profile(parameters.get("username"))
        elif skill_name == "get_user_tweets":
            result = self.skills.get_user_tweets(
                parameters.get("username"),
                parameters.get("count", 10)
            )
        elif skill_name == "get_user_followers":
            res
...[truncated 4591 chars]
Remediation
View remediation

Remediation Suggestions

  1. Validate parameters before dispatch and reject missing or incorrectly typed values.
  2. Require count to be a genuine integer, explicitly rejecting booleans, strings, zero, and negative values.
  3. Enforce conservative per-operation maximums, for example:
    python
    def validate_count(value, default, maximum):
    if value is None:
        return default
    if isinstance(value, bool) or not isinstance(value, int):
        raise ValueError("count must be an integer")
    if value < 1 or value > maximum:
        raise ValueError(f"count must be between 1 and {maximum}")
    return value
  4. Validate usernames and queries for presence, type, length, and expected format.
  5. Enforce throttling around every outbound request and pagination step rather than only once per high-level method.
  6. If the dependency performs pagination internally, configure its supported request-delay mechanism or implement bounded pagination in the wrapper.
  7. Add exponential backoff with jitter for rate-limit and transient network responses.
  8. Establish total request, response-size, memory, and execution-time budgets per Skill invocation.
  9. Add per-user and per-authentication-token quotas in services that expose this interface to multiple callers.
  10. Add tests covering extremely large, negative, non-integer, boolean, missing, and malformed parameter values.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (23)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The authentication guide tells users to extract the browser's X/Twitter auth_token cookie from developer tools and use it directly in the skill. That cookie is a live session credential; if exposed to the agent, logs, prompts, or storage, it can enable account takeover or unauthorized access well beyond the intended data extraction task.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The instructions to copy the auth_token cookie omit a strong warning that it is a sensitive bearer credential equivalent to account session access. Without explicit handling guidance, users may paste it into insecure channels or the system may log or persist it, materially increasing the chance of credential theft and downstream account compromise.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · index.html (reported line 14)May include surrounding context.

html
<meta property="og:type" content="website">
    <meta property="og:url" content="https://hardbrick21.github.io/Omni-X/">
    
    <!-- Twitter Card Meta Tags -->
    <meta name="twitter:card" content="summary_large_image">
    <meta name="twitter:title" content="Omni-X - AI Agent X (Twitter) Data Extraction">
    <meta name="twitter:description" content="Extract X (Twitter) data for AI agents - posts, followers, profiles, and media without official API">

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High
Category
YARA Match
Confidence
86% confidence
Finding

The guide recommends pip install git+https://github.com/yourusername/Omni-X.git, which performs remote code retrieval and installation directly from a Git repository. Even though this is common packaging practice, it is still a supply-chain risk because it encourages executing unpinned remote code at install time, and in an agent context that can enable bootstrap of unreviewed code with whatever privileges the environment has.

Content

Scanner excerpt · references/INSTALLATION.md (reported line 53)May include surrounding context.

th_token")

Execute a skill

result = interface.execute_skill( skill_name="get_user_tweets", parameters={"username": "elonmusk", "count": 5} )

print(result)

text

---

## Method 2: Install as Python Package (Recommended for Production)

### Step 1: Install the Package
```bash
# Install from local directory
cd /path/to/Omni-X
pip install -e .

# Or install directly from Git (if published)
pip install git+https://github.com/yourusername/Omni-X.git

Step 2: Use Anywhere

python
from scripts import TwitterSkillInterface

# Initialize and use
interface = TwitterSkillInterface(auth_token="your_auth_token")
result = interface.execute_skill(
    skill_name="get_user_profile",
    parameters={"username": "elonmusk"}
)

Method 3: Integrate as Git Submodule

Step 1: Add as Git Submodule

bash
cd /path/to/your/project
git submodule add <repository-url> omni-x
git submodule update --init --recursive

Step 2: Install Dependencies

bash
pip install -r om

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README states that some features require login, but it does not clearly disclose that users may need to provide authentication tokens, cookies, or other session material to the tool. In an agent-integrated context, that omission is security-relevant because users or downstream agents may supply sensitive session data without understanding the trust boundary, storage risks, or potential for account misuse if the token is exposed or mishandled.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill documentation includes executable examples and references capabilities that imply network access and local file reads, but it does not declare an explicit tool scope such as allowed-tools or permissions. This creates an authorization ambiguity where an agent may invoke broader capabilities than a reviewer or user expects, increasing the risk of unintended data access or outbound requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill advertises authenticated access to followers, followings, media, and search using an auth_token, but it does not clearly disclose that the user's authenticated session will be used to access platform data under that account context. This weak consent and privacy notice can lead users to provide credentials without understanding the scope of access or the privacy implications of acting through their logged-in account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The page explicitly encourages use of an authenticated X/Twitter auth token for follower, following, media, and search extraction, but does not warn users about privacy, account-security, Terms-of-Service, or account restriction risks. In the context of an AI-agent skill that automates scraping against a third-party platform, this omission can lead users to hand over sensitive session material without understanding the consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The guide repeatedly encourages use of a highly sensitive Twitter/X auth_token and even shows placeholder examples, but provides no warnings about secret handling, logging, storage, rotation, or avoiding hardcoding. In agent integrations, this creates a substantial risk that tokens will be embedded in prompts, source code, telemetry, or error logs, enabling account takeover or misuse of authenticated scraping capabilities.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide expands authentication beyond the declared skill model by instructing agents to use direct username/password login and load saved sessions. In an AI-agent context, this can cause collection, handling, or reuse of higher-sensitivity credentials and persistent sessions, increasing the chance of credential theft, unintended privilege expansion, or use of unrelated local sessions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The saved-session loading instruction encourages agents to inherit previously persisted authenticated state from the local environment. This can lead to ambient-authority abuse, cross-user data exposure, and accidental execution under a more privileged account than intended, especially on shared systems or reused containers.

Content

Scanner excerpt · references/AI_AGENT_GUIDE.md (reported line 301)May include surrounding context.

)

text

#### Method 3: Load Saved Session
```python
# If you previously saved a session with twitter.save_session()
interface.skills.twitter.load_session()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The document instructs users and AI agents to extract and reuse the Twitter/X auth_token cookie from a live browser session, which is a sensitive session credential. Reusing browser cookies outside the browser bypasses safer auth flows, increases risk of account/session theft, and normalizes unsafe handling of highly privileged secrets without any warning, scope limitation, or revocation guidance.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guide documents credential-based login and session load/save capabilities that go beyond the manifest's declared authentication model for this extraction skill. Expanding operator expectations around credentials and persistent sessions can enable the skill to handle more sensitive account access than intended, increasing the chance of over-privileged use, secret exposure, and unsafe integration patterns.

Content

No source excerpt is available for this finding.

Scope Creep

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation introduces direct username/password/email/phone login and persistent session handling, which materially broadens the sensitive data the skill may solicit or store. Even if presented as convenience features, this encourages collection of high-value credentials and reusable session state, creating avoidable account takeover and secret-retention risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

Documenting saved-session loading for a data-extraction skill promotes reuse of persistent authenticated state, which can outlive user intent and be consumed by later runs or other components. In this context, persistent sessions are especially risky because the skill accesses social-media account data and may operate in environments where session files are insufficiently protected.

Content

Scanner excerpt · references/LOGIN_GUIDE.md (reported line 42)May include surrounding context.

)

text

### Method 4: Load Saved Session
```python
from scripts import TwitterSkills

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The guide instructs users to extract a live browser auth_token cookie from developer tools and reuse it with the skill. That token is effectively a bearer session secret; documenting how to exfiltrate it from the browser without prominent adjacent warnings normalizes unsafe handling and could enable account compromise if the token is copied, logged, or reused improperly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code accepts a Twitter auth token and uses it to generate an authenticated session, which is access to sensitive credentials. While the docstring explains the argument's purpose, it does not warn users about the sensitivity of the token, safe handling expectations, or that authenticated access will be established using provided credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file demonstrates embedding and passing an authentication token without any warning or safer handling guidance, which can normalize insecure credential practices. In an agent-skill context, users or integrators may replace the placeholder with a real token and commit it, log it, or expose it through debugging, leading to account/session compromise.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

该文件本身是中文 README，但文档部分明确指出核心技能定义和 AI 代理参考文档为“英文”，整体未说明是否支持用户按需选择语言或 locale。按照语言/locale 政策，若技能内容隐含固定语言而未提供 opt-in 或选择机制，可构成自然语言层面的政策问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

SQP-3 applies to all file types and includes language or locale policy violations. The document declares English via both the html lang attribute and a language meta tag, but provides no indication that this is optional, user-selectable, or justified as a region-specific constraint.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation states certain skills require an auth token, but elsewhere tells agents to use alternate authentication methods. This inconsistency can mislead integrators into implementing insecure or overprivileged authentication flows and makes it harder to enforce a clear security model.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency is specified without a version pin, so installs may pull different upstream releases over time, including buggy or compromised versions. In a skill that extracts Twitter/X data and may handle authenticated sessions, a malicious or breaking update to tweeterpy could affect data integrity, availability, or potentially expose session material.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
tweeterpy

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The inline comment at L21 says this block will 'Test a skill that requires authentication', but the code invokes get_user_tweets, which the manifest explicitly lists as available in a guest session. This is an active contradiction between the documentation comment and the actual behavior being tested.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.