X (Twitter) API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:00 AM UTC
• Version: 1.0.15

Overview

This is mostly a disclosed X API reference, but it recommends an unaudited external plugin install and includes credential and arbitrary-text submission guidance that users should review carefully.

Install only if you are comfortable sending X queries, identifiers, use-case text, and any submitted analysis text to agntdata. Configure AGNTDATA_API_KEY through a trusted secret mechanism rather than pasting it into chat, and review or pin the @agntdata/openclaw-x plugin before installing it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21
• Finding: Unpinned Third-Party Plugin Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 21-34 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown ## Recommended: Install the Plugin **For the best experience, install the OpenClaw plugin for X (Twitter) API instead of this skill.** The plugin provides native MCP tools, automatic authentication, and structured parameter validation. Skill (this document): ```bash clawhub install agntdata-x ``` Plugin (native tools; npm package matches `package.json`): ```bash openclaw plugins install @agntdata/openclaw-x ``` ``` ### Technical Analysis The skill recommends installing the external npm package `@agntdata/openclaw-x` without specifying an immutable version or integrity digest. The package source is not included in the audited artifact, so its installation hooks, implementation, transitive dependencies, and runtime behavior cannot be verified from this project. An unversioned installation normally resolves to the registry's current release. Consequently, the effective code installed by this instruction can change after the skill has been reviewed. If the publisher account, package registry, release process, or a transitive dependency is compromised, a future release could introduce malicious code. This finding does not establish that the current external package is malicious. It identifies an unsafe dependency-installation instruction that lacks version and integrity controls. ### Attack Path 1. An attacker compromises the npm publisher account, release pipeline, package, or one of its dependencies. 2. The attacker publishes a modified release under the legitimate `@agntdata/openclaw-x` package name. 3. A user follows the documented unpinned installation command. 4. The installer resolves and downloads the attacker-controlled current release. 5. Any supported installation lifecycle logic executes during ...[truncated 847 chars]
• Remediation: ## Remediation Suggestions - Pin the plugin to a specifically reviewed version rather than resolving a mutable latest release. - Where supported, require and verify a cryptographic integrity digest or signed package provenance. - Audit the plugin source, installation scripts, bundled artifacts, and transitive dependency lockfile before recommending installation. - Disable npm lifecycle scripts during installation when they are unnecessary and the installation mechanism supports doing so. - Publish the expected package registry and reject alternate or untrusted package sources. - Run third-party plugins with least privilege, restricting filesystem access, environment-variable access, network destinations, and available OpenClaw tools. - Establish an update-review process so upgrades are not automatically trusted merely because the package name remains unchanged.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:41
• Finding: API Key Guidance May Cause Credential Disclosure Through Conversation Logs## Vulnerability Details **File Location**: `SKILL.md`, lines 41-49 **Vulnerability Type**: Unsafe handling of user-provided credentials **Risk Level**: Low **Vulnerable Code Snippet**: ```markdown Before making API calls, you need an API key. Get one from the [agntdata dashboard](https://app.agntdata.dev/dashboard). The API key should be available as the `AGNTDATA_API_KEY` environment variable. Every request must include it as a Bearer token: ``` Authorization: Bearer $AGNTDATA_API_KEY ``` If the environment variable is not set, ask the user to provide their API key or direct them to https://app.agntdata.dev/dashboard to create one. ``` ### Technical Analysis The skill correctly identifies an environment variable as the primary credential source but then instructs the agent to ask the user to provide the API key if that variable is absent. A user responding directly may paste the raw credential into the conversation. Conversation content can be retained in chat history, execution traces, observability systems, debugging records, or other logs. These channels are not equivalent to a dedicated secret store and may be visible to additional systems or operators. The instruction also does not require masked input, prohibit echoing the key, or require immediate redaction. The documented use of an HTTPS endpoint and a bearer token is not itself the issue. The vulnerability is the fallback procedure that can solicit a long-lived secret through the conversational interface. ### Attack Path 1. `AGNTDATA_API_KEY` is absent from the agent's environment. 2. Following the skill instruction, the agent asks the user to provide the API key. 3. The user pastes the raw key into the conversation. 4. The credential is retained in conversation history, agent traces, logs, or monitoring data. 5. A person or system with access to those records retrieves the key. 6. The exposed key is used to make authenticated requests to the ag ...[truncated 625 chars]
• Remediation: ## Remediation Suggestions - Remove the instruction to request the raw API key through the conversation. - Direct users to configure `AGNTDATA_API_KEY` through an approved environment configuration mechanism or dedicated secret manager. - If interactive entry is unavoidable, use a local masked secret prompt that does not transmit or store the value in conversation history. - Validate only whether the secret is configured; never print, echo, summarize, or return its value. - Apply log redaction for authorization headers and values matching the API-key format. - Ensure error messages and command tracing cannot expose bearer tokens. - Document key rotation and immediate revocation procedures for credentials accidentally submitted through chat. - Use narrowly scoped, short-lived credentials where the service supports them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

External Transmission

Medium

• Category: Data Exfiltration

Content

env:
        - AGNTDATA_API_KEY
      bins:
        - curl
    primaryEnv: AGNTDATA_API_KEY
    emoji: "⚡"
    homepage: https://agnt.mintlify.app/apis/social/x

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill encourages sending social queries, profile identifiers, and free-form text to an external API but does not warn that this data leaves the local environment. Users may unknowingly disclose sensitive research targets, personal data, or confidential text to a third party.

External Transmission

Medium

• Category: Data Exfiltration

Content

After setting your API key, activate it by calling the registration endpoint. This only needs to be done once per key:

```bash
curl -X POST https://api.agntdata.dev/v1/register \
  -H "Authorization: Bearer $AGNTDATA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"intendedApis": ["x"], "useCase": "Brief description of your use case"}'

• Confidence: 88% confidence
• Finding: The registration step sends the bearer API key plus a user-supplied use-case description to a third-party endpoint, creating an external transmission event that may include sensitive business context. Because the skill says this activation is required but does not discuss privacy or data minimization, users may disclose more than necessary.

External Transmission

Medium

• Category: Data Exfiltration

Content

These public endpoints (no API key required) let you explore this platform's capabilities:

```bash
curl https://api.agntdata.dev/v1/platforms/x
```

Returns: full endpoint list, OpenAPI spec, features, and use cases.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

These public endpoints (no API key required) let you explore this platform's capabilities:

```bash
curl https://api.agntdata.dev/v1/platforms/x
```

Returns: full endpoint list, OpenAPI spec, features, and use cases.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Base URL

```
https://api.agntdata.dev/v1/data/x
```

## Available Endpoints

• Confidence: 90% confidence
• Finding: The base URL establishes that all operational use of the skill sends data to a third-party API, including social graph queries and potentially arbitrary text passed to AI endpoints. In this context, the risk is not the URL itself but the undocumented breadth of data exported off-platform.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as an X/Twitter data access integration, but it also exposes unrelated AI text-analysis and translation endpoints. This broadens the capability surface beyond the declared purpose, making it easier for an agent to send arbitrary user-provided text to a third-party service without clear user awareness or consent.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Example

```bash
curl -X GET 'https://api.agntdata.dev/v1/data/x' \
  -H 'X-API-Key: your_api_key_here' \
  -H 'Content-Type: application/json'
```

• Confidence: 93% confidence
• Finding: The example uses a hardcoded placeholder API key in a header and encourages direct manual invocation of the remote service, which can normalize unsafe secret handling practices. Combined with inconsistent authentication documentation elsewhere, this increases the chance of credential misuse or accidental exposure.

Static analysis

No suspicious patterns detected.