v1.0.0

fapi.uk Twitter All-in-One API

ReviewClawScan verdict for this skill. Analyzed May 1, 2026, 6:47 AM.

Analysis

This is a real Twitter/X automation skill, but it asks for session-level Twitter credentials and can perform public account-changing actions through a third-party service without clear guardrails.

GuidanceReview carefully before installing. Use this only if you trust fapi.uk with your Twitter/X account access, avoid sharing auth tokens in chat, prefer a dedicated low-risk account, and require manual confirmation before any public post or account-changing action.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityHighConfidenceHighStatusConcern

SKILL.md

小龙虾会自己阅读本文件，智能选择接口、组装参数、带上 apiKey + auth_token，发送请求 ... createTweet ... tweetReply ... follow / unfollow ... blocksCreate / blocksDestroy

The instructions give the agent broad authority to select and send Twitter API requests, including public posting and account relationship changes, without requiring an explicit per-action confirmation step.

User impactA mistaken or overly broad agent action could post publicly, reply, follow/unfollow, block/unblock, or otherwise change the user's Twitter/X account state.

RecommendationRequire a clear preview and explicit user confirmation before any write action, especially tweets, replies, follows, blocks, unlocks, or paid/credit-consuming calls.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceMediumStatusNote

SKILL.md

npx clawhub@latest install fapi-twitter-full

The README/SKILL includes a user-directed installer command using `@latest`, and the install name differs from the registry slug shown for this review.

User impactA user could install a different or newer package than expected if they copy the command without verifying it.

RecommendationVerify the package name, source, and version before running the install command; prefer pinned versions when available.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityHighConfidenceHighStatusConcern

SKILL.md

openclaw config set skills.entries.fapi-twitter.auth_token "你的auth_token" ... ct0 "你的ct0（可选）" ... 或者直接在聊天里说：“我的 fapi apiKey 是 xxx，我的 auth_token 是 yyy”

The skill asks for API and Twitter session-style credentials, including `auth_token` and `ct0`, and even suggests sharing them in chat, despite the metadata declaring no primary credential.

User impactThese credentials can let the third-party service or anyone who sees them act through the user's Twitter/X account until the tokens are revoked or invalidated.

RecommendationInstall only if you trust fapi.uk and the skill author; avoid pasting tokens in chat, use a dedicated/low-risk account if possible, and revoke or rotate tokens after use.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityHighConfidenceHighStatusConcern

SKILL.md

Base URL：`https://fapi.uk/api/base/apitools/` ... 所有请求 必须 带 Header：`Authorization: Bearer {{apiKey}}` ... 大部分写操作需要 `auth_token` 和 `ct0` 参数

The skill routes API keys, Twitter session tokens, user content, and account actions through the external fapi.uk service, but the artifact does not define data handling, retention, or permission boundaries.

User impactSensitive account credentials and Twitter/X content may be exposed to or processed by a third-party provider outside OpenClaw.

RecommendationReview fapi.uk's trustworthiness and privacy/security policies before use, avoid sending sensitive DMs/media, and use dedicated credentials that can be revoked quickly.