ClawHub
Back to skill

Security audit

Twitter User Published Posts API

Security checks across malware telemetry and agentic risk

Overview

This is a narrow JustOneAPI helper for fetching Twitter user posts, with disclosed token use and no hidden persistence or destructive behavior.

Install only if you are comfortable using a JustOneAPI token for this endpoint. Run it in a trusted local environment, avoid sharing command logs or screenshots, and consider asking the publisher for a version that reads the token directly from the environment or uses an authorization header if the API supports it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill explicitly models the authentication token as a query parameter and then appends all query parameters to the request URL. Query-string credentials are routinely exposed through logs, browser/history artifacts, proxy telemetry, error reporting, and upstream monitoring systems, making accidental credential leakage much more likely than with an Authorization header. In this skill context, the risk is heightened because the token is required for every request to a third-party API service, so normal use repeatedly places the secret in the URL.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical
Code
suspicious.secret_argv_exposure
Location
SKILL.md:42