ClawHub
Back to skill

Security audit

Opentwitter

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a documented Twitter/X API wrapper, but it includes deleted-tweet access and persistent account monitoring that deserve user review before installation.

Install only if you trust the 6551 service with your OPENNEWS_TOKEN and the Twitter/X accounts, searches, tweet IDs, and watchlists you query. Treat deleted-tweet retrieval and account monitoring as sensitive; use them only for legitimate, authorized purposes and review any server-side watch entries you create.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (14)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description presents the skill as generic Twitter/X and meme evidence retrieval, but the body also exposes watchlist management and real-time monitoring capabilities. This mismatch can mislead users or calling agents about the surveillance-like functionality, reducing informed consent and increasing the chance the skill is invoked in contexts where persistent monitoring is inappropriate.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
env:
        - OPENNEWS_TOKEN
      bins:
        - curl
    primaryEnv: OPENNEWS_TOKEN
    emoji: "\U0001F426"
    install:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

Search with query:

bash
curl -s -X POST "https://ai.6551.io/open/twitter_search" \
  -H "Authorization: Bearer $OPENNEWS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "from:VitalikButerin bitcoin -filter:replies", "maxResults": 20, "product": "Top"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This endpoint transmits a target username to retrieve follower or unfollower events, enabling monitoring of another person's account activity through a third-party service. In context, this is more sensitive than routine retrieval because it supports behavioral surveillance and can be used to profile associations over time.

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

bash
# Get new followers
curl -s -X POST "https://ai.6551.io/open/twitter_follower_events" \
  -H "Authorization: Bearer $OPENNEWS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"username": "elonmusk", "isFollow": true, "maxResults": 20}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill documents capabilities to retrieve deleted tweets, follower changes, and maintain monitored-account watchlists, but it does not warn that these are sensitive surveillance-oriented operations. Without explicit privacy and acceptable-use guidance, an agent or user may employ the skill for covert monitoring, harassment, or collection of sensitive behavioral data.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The deleted-tweets endpoint facilitates retrieval of content that a user attempted to remove, which is inherently privacy-sensitive and can undermine user expectations around deletion. In this skill's context, that makes the external transmission meaningfully more dangerous than ordinary public-data lookup.

Content

Scanner excerpt · SKILL.md (reported line 204)May include surrounding context.

Get deleted tweets from a user.

bash
curl -s -X POST "https://ai.6551.io/open/twitter_deleted_tweets" \
  -H "Authorization: Bearer $OPENNEWS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"username": "elonmusk", "maxResults": 20}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
75% confidence
Finding

The KOL followers endpoint sends a target username for enrichment about who follows that account, which can reveal influence networks and affiliations. While less sensitive than deleted content, it still supports profiling and should be treated as a monitored-data capability rather than harmless lookup.

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

Get which KOLs (Key Opinion Leaders) are following a user.

bash
curl -s -X POST "https://ai.6551.io/open/twitter_kol_followers" \
  -H "Authorization: Bearer $OPENNEWS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"username": "elonmusk"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 235)May include surrounding context.

Get Twitter article by ID.

bash
curl -s -X POST "https://ai.6551.io/open/twitter_article_by_id" \
  -H "Authorization: Bearer $OPENNEWS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"id": "article_id"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

This endpoint retrieves a tweet by ID and automatically fetches any tweets it replies to or quotes, providing complete context.

bash
curl -s -X POST "https://ai.6551.io/open/twitter_tweet_by_id" \
  -H "Authorization: Bearer $OPENNEWS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"twId": "2030318958512164966"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.

Get tweets that quote a specific tweet.

bash
curl -s -X POST "https://ai.6551.io/open/twitter_quote_tweets_by_id" \
  -H "Authorization: Bearer $OPENNEWS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"id": "2030318958512164966", "maxResults": 20}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 288)May include surrounding context.

Get users who retweeted a specific tweet.

bash
curl -s -X POST "https://ai.6551.io/open/twitter_retweet_users_by_id" \
  -H "Authorization: Bearer $OPENNEWS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"id": "2030318958512164966"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The watch-list endpoints expose persistent monitoring of Twitter accounts tied to the authenticated user's token, which materially changes the skill from passive lookup to active surveillance configuration. Because the top-level description under-discloses this, the external transmission here is more dangerous and can lead to silent long-term tracking of targets.

Content

Scanner excerpt · SKILL.md (reported line 304)May include surrounding context.

Get all Twitter monitoring users for the current user.

bash
curl -s -X POST "https://ai.6551.io/open/twitter_watch" \
  -H "Authorization: Bearer $OPENNEWS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 344)May include surrounding context.

Delete a Twitter user from monitoring list by username.

bash
curl -s -X POST "https://ai.6551.io/open/twitter_watch_delete" \
  -H "Authorization: Bearer $OPENNEWS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"username": "elonmusk"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 552)May include surrounding context.

Crypto Twitter KOL Tweets

bash
curl -s -X POST "https://ai.6551.io/open/twitter_user_tweets" \
  -H "Authorization: Bearer $OPENNEWS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"username": "VitalikButerin", "maxResults": 10}'

Static analysis

No suspicious patterns detected.