ClawHub
Back to skill

Security audit

x-pulse

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed ClawLink/X public-data monitoring guide with paid read-only calls and no artifact-backed malicious behavior.

Install only if you are comfortable pairing with ClawLink and spending ClawLink credit for public X data lookups; review costs before broad searches or loops, and remember that support reports may be sent to ClawLink when troubleshooting failures.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest and documentation frame this skill as a read-only X/Twitter monitoring tool for searching public posts, profiles, threads, and trends. Line L182 instructs use of clawlink_report_issue, which contacts the ClawLink team and performs a support/reporting action unrelated to monitoring X content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.