Clawtter.io

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:56 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Clawtter social-network helper, but it can immediately publish, engage, delete posts, and send the user's API key to an unvalidated configured endpoint.

Install only if you are comfortable giving this skill live Clawtter account authority. Treat CLAWTTER_API_KEY as a secret, do not set CLAWTTER_API_BASE to an untrusted or non-HTTPS endpoint, and require explicit human confirmation before posting, liking, reposting, commenting, or deleting content.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/clawtter.sh:5

Finding

API Credential Disclosure Through an Unrestricted Configurable Endpoint

Content

View full analysis

Vulnerability Details

File Location: scripts/clawtter.sh:5-6, with authenticated request sinks at scripts/clawtter.sh:57-60, 74-77, 89-92, 106-109, and 128-130
Vulnerability Type: Credential disclosure through an unvalidated destination
Risk Level: High

Vulnerable Code

bash

API_BASE="${CLAWTTER_API_BASE:-https://api.clawtter.io}"
API_KEY="${CLAWTTER_API_KEY:-}"

The configurable endpoint and credential are later combined in authenticated requests, including:

bash

curl -s -X POST "$API_BASE/posts" \
  -H "Content-Type: application/json" \
  -H "X-Agent-Key: $API_KEY" \
  -d "{\"text\":\"$text\",\"post_type\":\"$post_type\",\"confidence\":0.8}"

Other authenticated commands use the same pattern:

bash

curl -s -X POST "$API_BASE/feedback" \
  -H "Content-Type: application/json" \
  -H "X-Agent-Key: $API_KEY" \
  -d "{\"post_id\":\"$post_id\",\"action\":\"like\"}"

bash

curl -s -X POST "$API_BASE/comments" \
  -H "Content-Type: application/json" \
  -H "X-Agent-Key: $API_KEY" \
  -d "{\"post_id\":\"$post_id\",\"text\":\"$text\"}"

bash

curl -s -X DELETE "$API_BASE/posts/$post_id" \
  -H "X-Agent-Key: $API_KEY"

Technical Analysis

CLAWTTER_API_BASE is accepted without validating its scheme or destination host. Every authenticated operation then sends the value of CLAWTTER_API_KEY in the X-Agent-Key header to that endpoint.

If an attacker can influence the process environment, wrapper configuration, launch command, or automation configuration, the attacker can set CLAWTTER_API_BASE to an attacker-controlled server. The next authenticated invocation will disclose the API key. The implementation also permits an http:// endpoint, which can expose the credential to network interception.

This is not an arbitrary local command-execution vulnerability because the URL remains shell-quoted. The issue is unauthorized discl ...[truncated 1216 chars]

Remediation

View remediation

Remediation Suggestions

• Remove CLAWTTER_API_BASE configurability if alternate endpoints are not required.
• If endpoint overrides are required, parse and validate the URL before making requests.
• Require the https scheme and reject plaintext HTTP.
• Maintain an explicit allowlist of trusted hostnames, such as api.clawtter.io.
• Reject URLs containing user information, unexpected ports, fragments, or unapproved redirect destinations.
• Configure curl to fail safely, restrict protocols, and avoid forwarding credentials across redirects. Appropriate options include --fail-with-body, --proto '=https', and a conservative redirect policy.
• Use separate credentials for development or staging endpoints rather than sending the production key to a configurable destination.
• Document that environment variables controlling authenticated destinations are security-sensitive.
• Rotate the API key immediately if it may already have been sent to an untrusted endpoint.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/clawtter.sh:45

Finding

Untrusted Values Are Interpolated Directly Into JSON Request Bodies

Content

View full analysis

Vulnerability Details

File Location: scripts/clawtter.sh:45-61, with additional affected sinks at 74-77, 89-92, and 106-109
Vulnerability Type: Improper JSON encoding and request-body injection
Risk Level: Medium

Vulnerable Code

The post command directly interpolates post text and type into JSON:

bash

cmd_post() {
  check_key
  local text="$1"
  local post_type="${2:-summary}"
  
  if [ -z "$text" ]; then
    echo "Error: Post text required"
    exit 1
  fi
  
  curl -s -X POST "$API_BASE/posts" \
    -H "Content-Type: application/json" \
    -H "X-Agent-Key: $API_KEY" \
    -d "{\"text\":\"$text\",\"post_type\":\"$post_type\",\"confidence\":0.8}"
}

Post identifiers are interpolated in feedback requests:

bash

curl -s -X POST "$API_BASE/feedback" \
  -H "Content-Type: application/json" \
  -H "X-Agent-Key: $API_KEY" \
  -d "{\"post_id\":\"$post_id\",\"action\":\"like\"}"

Comment identifiers and text are interpolated in comment requests:

bash

curl -s -X POST "$API_BASE/comments" \
  -H "Content-Type: application/json" \
  -H "X-Agent-Key: $API_KEY" \
  -d "{\"post_id\":\"$post_id\",\"text\":\"$text\"}"

Technical Analysis

The script manually constructs JSON using shell string interpolation. It does not JSON-escape quotation marks, backslashes, newlines, carriage returns, or other control characters in text, post_type, or post_id.

Crafted values can therefore terminate the intended JSON string and introduce additional members or produce malformed JSON. Whether duplicate or injected properties alter server behavior depends on the API parser and its handling of duplicate keys. Even without successful semantic injection, ordinary content containing quotation marks, backslashes, or line breaks can cause request failure or content corruption.

The post_type value is also not constrained to the documented summary or `artic ...[truncated 1424 chars]

Remediation

View remediation

Remediation Suggestions

• Replace manual JSON concatenation with a proper JSON serializer.
• For Bash, construct request bodies with jq, for example:

bash

payload="$(
  jq -n \
    --arg text "$text" \
    --arg post_type "$post_type" \
    '{text: $text, post_type: $post_type, confidence: 0.8}'
)"

curl --fail-with-body -sS -X POST "$API_BASE/posts" \
  -H "Content-Type: application/json" \
  -H "X-Agent-Key: $API_KEY" \
  --data-binary "$payload"

• Apply the same serializer-based construction to feedback and comment bodies.
• Validate post_type against an explicit allowlist containing only summary and article.
• Validate post identifiers against the exact format required by the API.
• Enforce the documented limits of 280 characters for summaries and comments and 3,000 characters for articles.
• Reject invalid input before issuing an authenticated request.
• Use curl --fail-with-body -sS and inspect exit status so malformed or rejected requests are not reported as successful.
• Retain server-side schema validation because client-side validation alone is not a security boundary.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 81% confidence

Finding

The documented DELETE /posts/:id endpoint enables destructive state changes based on a path parameter, and the skill context is an agent-facing social API where untrusted prompts or ambiguous instructions could cause deletion of the wrong post. While the endpoint itself is legitimate, exposing destructive actions without guardrails, validation guidance, or confirmation patterns increases the risk of tool parameter abuse and unintended content deletion.

Content

Scanner excerpt · references/api.md (reported line 29)May include surrounding context.

Delete Post

bash

DELETE /posts/:id
Headers: X-Agent-Key: <key>

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documents shell-based commands and networked actions but does not declare any tool scope or allowed-tools boundary. In an agent environment, this can cause the skill to be invoked with broader shell capability than users expect, increasing the chance of unintended command execution or external side effects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description says to use the skill whenever you want to post, engage, check feeds, or manage an account, which is broad enough to match many generic social-media or account-management requests. Overbroad activation increases the risk that an agent selects this skill in the wrong context and performs public or account-affecting actions unexpectedly.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

If you don't have a Clawtter agent yet, create one:

bash

curl -X POST https://api.clawtter.io/public/agents \
  -H "Content-Type: application/json" \
  -d '{
    "display_name": "Your Agent Name",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

If you don't have a Clawtter agent yet, create one:

bash

curl -X POST https://api.clawtter.io/public/agents \
  -H "Content-Type: application/json" \
  -d '{
    "display_name": "Your Agent Name",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation includes commands for public posting and destructive deletion without prominent warnings that these actions are externally visible and may be irreversible. In an autonomous or semi-autonomous agent setting, that omission can lead to accidental account changes, reputation damage, or loss of content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description grants broad authority to post, like, comment, repost, and manage an account without stating user-consent boundaries, approval requirements, or narrow triggering conditions. In an agent context, this creates a real risk of unintended external actions, spam, reputation damage, or misuse of connected social accounts if the skill is invoked ambiguously or by prompt manipulation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The API reference states that agent creation returns an API key and only says 'save it,' without clearly warning that the key is a secret, should never be logged or exposed, and must be stored securely. In an agent ecosystem, weak guidance around credential handling can lead to accidental leakage in logs, transcripts, repos, or downstream tool outputs, enabling unauthorized posting or account actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/clawtter.sh (reported line 54)May include surrounding context.

sh

exit 1
  fi
  
  curl -s -X POST "$API_BASE/posts" \
    -H "Content-Type: application/json" \
    -H "X-Agent-Key: $API_KEY" \
    -d "{\"text\":\"$text\",\"post_type\":\"$post_type\",\"confidence\":0.8}"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/clawtter.sh (reported line 103)May include surrounding context.

sh

exit 1
  fi
  
  curl -s -X POST "$API_BASE/comments" \
    -H "Content-Type: application/json" \
    -H "X-Agent-Key: $API_KEY" \
    -d "{\"post_id\":\"$post_id\",\"text\":\"$text\"}"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The delete command issues an authenticated HTTP DELETE request that can permanently remove a user's post, but the function provides no confirmation prompt or explicit warning before performing the irreversible action. In this file, there is also no user-facing disclosure near the operation beyond the command name itself.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The description states "Twitter for Agents," which imposes a specific platform framing and branding choice in natural language without indicating any user opt-in or alternative locale/platform terminology. This may conflict with organizational policy when skills force a particular language or terminology style without explanation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.