ClawHub
Back to skill

Security audit

X Master

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent X/Twitter routing skill, but users should understand that it relies on third-party services and optional posting-related tools before installing them.

Install this as a routing/documentation skill only if you are comfortable with its X/Twitter focus. Treat fxtwitter as a third-party proxy: avoid using it for sensitive investigations unless that disclosure is acceptable, and prefer official or trusted internal APIs where needed. Keep posting in draft-only or manual approval mode, and review/pin any optional sub-skills before installing them or exposing X OAuth credentials.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:217
Finding

Unpinned Third-Party Skill Installations Create a Supply-Chain Risk

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (16)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/fxtwitter-pattern.md (reported line 13)May include surrounding context.

  1. JavaScript Rendering: Twitter/X renders content dynamically via JavaScript. Raw HTTP GET returns an empty HTML shell with no content.
    html
    <!-- What you get from direct x.com fetch -->
<html><body><!-- JS app loads here --></body></html>

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README directs users to retrieve tweet content through the third-party fxtwitter proxy and emphasizes it as the default pattern, but it does not disclose that tweet URLs, query targets, and related access metadata are sent to an external service outside the user's control. In an agent setting, this can leak user interests, monitored accounts, private investigation targets, or sensitive operational context whenever the skill is used to read tweets.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The example curl command instructs users to send tweet requests directly to api.fxtwitter.com, which is an external service, without any warning about data disclosure or trust implications. Even though the sample uses a public example URL, normal use would transmit real tweet targets and usage patterns to a third party, which is significant in a security-sensitive agent workflow.

Content

Scanner excerpt · README.md (reported line 114)May include surrounding context.

4. Test fxtwitter Access

bash
curl "https://api.fxtwitter.com/example/status/1234567890" | jq .

You should get JSON response with tweet content.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The skill instructs the agent to transmit user-supplied tweet identifiers and usernames to a third-party endpoint, api.fxtwitter.com, rather than an official first-party service. Even though the data is public tweet metadata, this creates an external dependency and privacy/integrity risk because user activity, accessed URLs, and retrieved content are exposed to an unaffiliated service that could log, modify, or become unavailable.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

Always use fxtwitter for reading tweet content:

text
https://api.fxtwitter.com/{username}/status/{tweet_id}

Extract username and tweet_id from the x.com URL:

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This operational instruction concretely directs web_fetch to send request data to api.fxtwitter.com for all tweet reads, making the external transmission behavior actionable. In context, the risk is amplified because the skill labels this as a hard rule, which may prevent safer alternatives and normalize sending browsing targets to a third-party service without trust verification or consent.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

When: You have an x.com/twitter.com link and need to read the content How:

text
web_fetch("https://api.fxtwitter.com/{username}/status/{id}")

Response includes: full text, author, engagement stats, media URLs, thread context via reply_to

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The listed activation examples include phrases like "What are people saying about X" and "search X for Y," which are broad natural-language requests that could arise in many contexts. The file does not provide negative examples or clearer constraints for when this router should activate versus other research or social-analysis skills.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger text "Trend research requests, topic popularity analysis" is very broad and does not define concrete invocation phrases or boundaries. Without explicit scope or negative examples, the skill may be invoked for generic research requests that were not intended for this sub-tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The document gives explicit optimization advice for AI assistant/bot accounts to increase reach and engagement, but omits any warning about X platform rules, anti-spam enforcement, automation disclosure, or reputational risks. In a master routing skill for X/Twitter operations, this can directly shape agent behavior toward engagement-maximizing tactics that may violate policy or encourage manipulative automated participation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This instruction hard-codes use of an external third-party endpoint, causing tweet identifiers and request metadata to be sent outside the trusted environment. In an agent setting, repeated automated use can expose user activity patterns and create dependency on an unvetted external service.

Content

Scanner excerpt · references/fxtwitter-pattern.md (reported line 67)May include surrounding context.

Step 2: Construct fxtwitter URL

text
https://api.fxtwitter.com/{username}/status/{tweet_id}

Example:

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The example reinforces a pattern of sending content lookups to a public proxy service without any warning or trust boundary discussion. That can normalize unsafe data egress in downstream implementations and obscure the privacy implications of third-party processing.

Content

Scanner excerpt · references/fxtwitter-pattern.md (reported line 72)May include surrounding context.

Example:

text
https://api.fxtwitter.com/example/status/1234567890

Step 3: Fetch and Parse JSON

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The pattern tells agents to transmit user-supplied X URLs and derived identifiers to a third-party proxy without any notice, consent guidance, or data-handling constraints. Even if tweet IDs are often public, user requests, access patterns, and private/internal links can leak to an external service, creating privacy, compliance, and telemetry exposure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The pseudo-code operationalizes direct outbound fetching to a public service, making external transmission part of the recommended implementation. Because agent developers may copy this verbatim, it increases the chance of silent data egress and insufficient review of logging, retention, and consent implications.

Content

Scanner excerpt · references/fxtwitter-pattern.md (reported line 81)May include surrounding context.

javascript
// Pseudo-code
const response = await web_fetch("https://api.fxtwitter.com/example/status/1234567890");
const data = JSON.parse(response);

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The workflow example instructs construction and use of a third-party URL as the normal processing path. In context, the danger is not code execution but normalized external exfiltration of request targets and usage metadata to infrastructure outside the operator's control.

Content

Scanner excerpt · references/fxtwitter-pattern.md (reported line 143)May include surrounding context.

md
### Process
1. Extract: `username=example`, `tweet_id=1234567890`
2. Construct: `https://api.fxtwitter.com/example/status/1234567890`
3. Fetch and parse JSON
4. Extract fields

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This sample code combines caching with direct calls to a third-party endpoint, which can inadvertently retain fetched content locally while also sending queries externally. Without retention guidance, this creates both privacy exposure to the proxy and local data-handling risk.

Content

Scanner excerpt · references/fxtwitter-pattern.md (reported line 263)May include surrounding context.

if (cache[tweetId]) { return cache[tweetId]; // Return cached } const data = await web_fetch(https://api.fxtwitter.com/${username}/status/${tweetId}); cache[tweetId] = data; return data;

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The rule 'Always use' the public proxy makes third-party transmission mandatory and discourages safer alternatives. In a master routing skill, such normative wording is more dangerous because it can propagate across many agent workflows and institutionalize external data sharing.

Content

Scanner excerpt · references/fxtwitter-pattern.md (reported line 336)May include surrounding context.

The rule: Never fetch x.com directly. Always use:

text
https://api.fxtwitter.com/{username}/status/{tweet_id}

Extract from: https://x.com/{username}/status/{tweet_id}

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The manifest describes x-master as a master routing skill for many X/Twitter operations, but this file is maintained as part of x-master and documents only a narrow tweet-fetching pattern via fxtwitter. That creates a semantic mismatch between the skill-level description and what this component actually represents, even though the file itself is documentation rather than executable code.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.