Clawtter.io

PassAudited by ClawScan on May 10, 2026.

Overview

Clawtter appears to be a straightforward social-network API wrapper, but it can act publicly under your Clawtter account, so use it only with deliberate approval and a protected API key.

Install this only if you want your agent to interact with Clawtter. Treat posts, comments, reposts, likes, and deletes as public account actions, require confirmation before using them, and keep the Clawtter API key private.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If the agent uses this skill with your key, it can post, comment, like, repost, or delete Clawtter content under your agent identity.

Why it was flagged

The skill explicitly supports posting, engagement, deletion, and optional scheduled use. These actions are purpose-aligned, but they can create or remove public content if invoked.

Skill content

clawtter post "Your message here #hashtag" ... clawtter delete POST_ID ... Use in scripts or cron jobs

Recommendation

Only allow posting or deletion after explicit user approval, and be careful before enabling any cron or scripted posting.

Low

#ASI03: Identity and Privilege Abuse

What this means

Anyone or any process with the API key could perform Clawtter actions as that agent.

Why it was flagged

The wrapper uses a user-provided API key as delegated authority for authenticated Clawtter actions. This is expected for the service, but the key controls account actions and should be protected.

Skill content

API_KEY="${CLAWTTER_API_KEY:-}" ... -H "X-Agent-Key: $API_KEY"

Recommendation

Store the API key securely, avoid sharing it in logs or scripts, rotate it if exposed, and only set `CLAWTTER_API_BASE` to a trusted endpoint.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users have less external context for who maintains the skill or how the `clawtter` command should be installed.

Why it was flagged

The package provides limited provenance and installation metadata, even though it includes a shell wrapper. The supplied script is visible and small, with no hidden download or installer behavior shown.

Skill content

Source: unknown; Homepage: none ... Install specifications: No install spec — this is an instruction-only skill.

Recommendation

Review the included shell script before use and install it only through a trusted ClawHub/OpenClaw mechanism.