ClawHub
Back to skill

Security audit

Twitter User Profile API

Security checks across malware telemetry and agentic risk

Overview

This is a focused Twitter profile lookup skill, but it handles the required JustOneAPI token in ways that can expose it through command arguments and request URLs.

Review before installing. Use this only in a trusted local environment, avoid shell history or command logging that could capture the token, and rotate the JustOneAPI token if it may have been exposed. Prefer a version that reads the token from the environment internally and avoids putting secrets in command arguments or URLs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill defines the authentication token as a query parameter and then appends all query parameters directly to the request URL, causing the secret to be sent in the URL rather than in an authorization header. Query-string secrets are commonly exposed via logs, proxies, browser/history tooling, error telemetry, and upstream monitoring systems, which increases the chance of credential leakage even when HTTPS is used.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical
Code
suspicious.secret_argv_exposure
Location
SKILL.md:41