Twitter Content Generator

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:03 AM UTC
• Version: 1.0.9

Overview

This skill does generate Twitter/X content, but it also automatically contacts a payment service using an embedded merchant credential, so it should be reviewed before install.

Install only if you are comfortable with a paid per-use skill that contacts SkillPay before generating content. The publisher should remove and rotate the embedded merchant credential, require explicit user configuration and confirmation for charges, use HTTPS registry sources, pin installer versions, and align the package versions before this is treated as low risk.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:17

Finding

Hardcoded SkillPay Merchant Credential Used for Payment Requests

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: package-lock.json:23

Finding

Dependencies Retrieved from Plaintext Third-Party Mirror and Mutable Installer Version

Content

View full analysis

Remediation

View remediation

install twitter-content-generator ``` 6. Where supported, pin and verify the installer package integrity or distribute it through a signed release channel. 7. Align the versions in `package.json`, `package-lock.json`, and `SKILL.md`, then regenerate release artifacts. 8. Add CI checks that reject plaintext dependency URLs, unapproved registries, lockfile inconsistencies, and mutable installer references. 9. Run dependency vulnerability and provenance checks before each release. 10. Consider disabling dependency lifecycle scripts during controlled installation where they are not required. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A skill marketed as tweet generation but also performing payment-related actions creates a trust and transparency failure. Even if payment is expected for a paid skill, failing to clearly declare billing behavior can lead to unauthorized or confusing transactions and makes abuse harder to detect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A skill marketed as tweet generation but also performing payment-related actions creates a trust and transparency failure. Even if payment is expected for a paid skill, failing to clearly declare billing behavior can lead to unauthorized or confusing transactions and makes abuse harder to detect.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · index.js (reported line 90)May include surrounding context.

js

prompt += `\nFormat each tweet as:\n[TWEET 1]\ncontent...\n\n[TWEET 2]\ncontent...`;
  }
  
  return prompt;
}

/**

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The lockfile pins axios 1.13.6, and the static analysis indicates multiple advisories affecting that version, including SSRF-related NO_PROXY bypass behavior and prototype-pollution-assisted request/response manipulation. In an agent skill that likely makes outbound HTTP requests to generate or fetch Twitter/X-related content, a vulnerable HTTP client increases the risk of server-side request forgery, credential leakage, or man-in-the-middle style abuse depending on how requests are constructed.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 84% confidence

Finding

form-data 4.0.5 is reported as vulnerable to CRLF injection via unescaped multipart field names and filenames. If this skill ever builds multipart requests using attacker-influenced values, an attacker may be able to alter request structure or inject unintended headers/body content, which can lead to request smuggling-like effects against downstream services.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to execute npx clawhub@latest install twitter-content-generator, which fetches and runs remote code at install time without pinning to an immutable version. That creates a supply-chain risk: if the package is updated maliciously or compromised, users following the documentation may execute attacker-controlled code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README states that usage is paid per invocation and that payment is handled automatically via an embedded merchant key, but it does not present a prominent warning about charges, payment triggers, limits, or user consent flow. In a CLI skill context, this can lead to unexpected financial charges and weakens informed consent, especially when combined with a simple one-command install and execution model.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill references environment variables and operational capabilities but does not declare any explicit tool scope or permissions boundary. In a skill ecosystem, this increases the risk of unintended access to secrets or runtime capabilities because users and hosting platforms cannot clearly determine what the skill is allowed to read or use.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 99% confidence

Finding

The configuration contains a hardcoded merchant key fallback embedded directly in source code. Hardcoded secrets are vulnerable to source disclosure, reuse by unauthorized parties, and accidental charging against the embedded account; in this context, it is especially dangerous because the skill automatically uses that key if the environment variable is absent.

Content

Scanner excerpt · index.js (reported line 17)May include surrounding context.

js

// Configuration
const CONFIG = {
  skillpay_api: 'https://api.skillpay.me/v1',
  merchant_key: process.env.SKILLPAY_MERCHANT_KEY || 'sk_91fff75ae2a7a71f8eceadcbcd816e24d57e58d9d04ccca45f0b3856af130aea',
  price_per_use: 0.002,
  currency: 'USDT',

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The implementation executes an external openclaw binary via child_process.spawn, which is a stronger system capability than the manifest's simple content-generation description suggests. While invoking an AI backend is expected, spawning a local executable is not an obvious or explicitly declared requirement from the stated purpose alone.

Content

No source excerpt is available for this finding.

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · index.js (reported line 141)May include surrounding context.

js

* Fallback to API call
 */
async function fallbackAPICall(prompt) {
  const response = await axios.post('http://localhost:18789/api/agent/run', {
    agentId: 'sloan',
    prompt: prompt,
    stream: false

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is presented as a Twitter/X content generator, but its normal execution path charges an external payment service before doing the stated task. This creates a capability and trust mismatch: users invoking a content tool may unknowingly trigger financial transactions, especially because payment is enabled by default and only skipped with a test flag.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Including payment processing inside a content-generation skill is security-relevant because it extends the skill's behavior into financial operations not implied by the primary purpose. Even if intended for monetization, hidden or unexpected charging increases the risk of unauthorized spending and abuse in automated environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code sends a sensitive merchant credential in an outbound request during normal execution, without an explicit runtime warning or confirmation step before charging. In agentic or automated contexts, this can silently monetize user actions or misuse the operator's billing account, especially when combined with the hidden default key fallback.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The test suite validates payment-processing behavior in a skill described only as a Twitter/X content generator, indicating hidden or undocumented capability. Undisclosed financial functionality expands the attack surface, can bypass reviewer/user expectations, and may enable monetization flows or credential handling unrelated to the stated purpose of the skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

A payment capability appears unjustified for a Twitter/X content generation skill, which is a strong indicator of over-privileged or deceptive functionality. Even though this file is only a test, it confirms the existence of a payment flow that could expose users to phishing-style payment URLs, unauthorized charges, or collection of sensitive financial/API-related data outside the expected feature set.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

follow-redirects 1.15.11 is flagged for leaking custom authentication headers across cross-domain redirects. Because axios depends on this package, any authenticated outbound request that follows redirects could unintentionally disclose API keys, bearer tokens, or other headers to attacker-controlled domains if redirect targets are not strictly validated.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is version-ranged with a caret (^1.6.0), which allows installation of newer minor/patch releases that may differ from what was originally tested. In a skill package, this weakens supply-chain integrity and can silently introduce breaking changes or newly vulnerable versions during install.

Content

Scanner excerpt · package.json (reported line 23)May include surrounding context.

json

"author": "Matt",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.6.0"
  },
  "engines": {
    "node": ">=18.0.0"

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index.js:98

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: index.js:18