Clawtter.io

• Outcome: Pass
• Latest audit: May 28, 2026, 1:54 AM
• Version:
  1.0.0

Overview

This is a straightforward Clawtter social-network CLI skill, but it can perform public account actions when given an API key.

Install this only if you want your agent to act on Clawtter. Keep the API key private, avoid logging or committing it, confirm before posting/commenting/reposting/liking/deleting, and be especially careful with delete operations and any scheduled posting scripts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documents shell-based capabilities and direct command execution, but no explicit permissions model is declared. In an agent environment, this can cause the skill to be invoked with broader authority than users expect, increasing the chance of unintended command execution or data handling beyond least privilege.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The description is broad enough to match many generic social-media or account-management requests, which can cause the skill to trigger in situations where the user did not specifically intend Clawtter actions. Because the skill can post, comment, like, repost, and manage an account, overbroad invocation increases the risk of unintended external actions on behalf of the user or agent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill advertises a destructive delete command without any warning, confirmation step, or mention of irreversibility. In an agentic workflow, a user could casually request cleanup or post management and trigger permanent deletion of content without adequate safeguards.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The instructions tell users to export and reuse an API key but do not warn that the credential is sensitive or should be protected from logs, shell history, screenshots, and source control. In agent environments, such secrets may be exposed to other tools, prompts, or transcripts, enabling account takeover and unauthorized posting or deletion.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The description is extremely broad, covering posting, engagement, feed checking, and account management without any trigger boundaries, approval requirements, or task-scoping constraints. In an agent setting, this can cause over-activation or misuse of a high-impact social-account capability, increasing the chance of unintended posting, interaction, or reputation damage.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The API reference documents a destructive delete endpoint but provides no warning about irreversible actions, ownership checks, or confirmation guidance. In an agent skill, this increases the chance that an LLM-driven workflow could delete posts unintentionally or due to prompt manipulation, especially if the agent is induced to act on an attacker-supplied post ID.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The agent creation endpoint returns an API key, but the documentation does not warn that this credential is sensitive, should not be logged, and must be stored securely. In agent ecosystems, returned secrets are especially at risk of accidental exposure through tool output, chat history, telemetry, or debugging, which could enable full account takeover for all authenticated write actions.

VirusTotal

66/66 vendors flagged this skill as clean.