ClawHub
Back to skill

Security audit

Twitter/X API

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Twitter/X API helper that uses user-provided credentials to read, post, reply, and send DMs, with no hidden persistence or unrelated data access found.

Install only if you intend to let the agent operate your Twitter/X account. Prefer environment variables or a secret manager over the optional plaintext credentials file, use the minimum API scopes needed, install dependencies in a virtual environment, and carefully review any post, reply, thread, or DM command before running it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:43
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 43
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash
pip install tweepy

Technical Analysis

The setup instructions install the latest available release of tweepy without a version constraint, lock file, or integrity hash. Consequently, the dependency resolved during installation may differ from the version reviewed during the Skill audit.

This creates supply-chain exposure: if the package, a transitive dependency, or its distribution channel is compromised, following the documented setup command could install attacker-controlled code. Python packages may execute code during installation, and imported package code runs when scripts/tweet.py starts.

Although no evidence indicates that the current tweepy package is malicious, the installation instruction does not provide reproducible or integrity-verified dependency resolution.

Attack Path

  1. An attacker compromises a future tweepy release, one of its transitive dependencies, or the relevant package publishing account.
  2. A user follows the setup instructions and runs pip install tweepy.
  3. The package resolver downloads the compromised release because no reviewed version or hash is required.
  4. Malicious installation or import-time code executes with the privileges of the user running pip.
  5. That code may inspect the documented Twitter environment variables or credential file and misuse the authenticated account.

Impact Assessment

Successful exploitation would run code with the privileges of the installing user. The exposed scope could include:

  • Twitter API keys, access tokens, access secrets, and bearer tokens available in the process environment or ~/.config/twitter/credentials.json.
  • Unauthorized access to the Twitter capabilities granted to those credentials, including posting, replying, reading permitted account data, and sending or reading direct me ...[truncated 249 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin tweepy to a specifically reviewed version rather than installing an unconstrained latest release.
  • Use a lock file and require cryptographic hashes for the complete dependency set, such as with a hash-locked requirements file and pip install --require-hashes -r requirements.txt.
  • Install dependencies in a dedicated virtual environment with only the permissions needed to run the Skill.
  • Review and update dependency pins through a controlled process that includes vulnerability and provenance checks.
  • Avoid exposing credentials during dependency installation. Install and verify dependencies before exporting Twitter secrets or creating the credential file.
  • Consider documenting a reproducible setup similar to:
bash
python3 -m venv .venv
. .venv/bin/activate
python -m pip install --require-hashes -r requirements.txt

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: twitter
description: "X/Twitter messaging management via API. Read tweets, post tweets, reply, send DMs, search, and view analytics. Use when the user wants to interact with X/Twitter: (1) posting or scheduling tweets, (2) reading timeline/mentions/DMs, (3) replying to tweets, (4) searching tweets/users/hashtags, (5) checking engagement analytics. Requires Twitter API credentials (API key, API secret, access token, access secret) or Bearer token."
---

# Twitter/X API Skill

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: twitter
description: "X/Twitter messaging management via API. Read tweets, post tweets, reply, send DMs, search, and view analytics. Use when the user wants to interact with X/Twitter: (1) posting or scheduling tweets, (2) reading timeline/mentions/DMs, (3) replying to tweets, (4) searching tweets/users/hashtags, (5) checking engagement analytics. Requires Twitter API credentials (API key, API secret, access token, access secret) or Bearer token."
---

# Twitter/X API Skill

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Credentials

Store credentials in environment variables or ~/.config/twitter/credentials.json:

bash
export TWITTER_API_KEY="your-api-key"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

Credentials

Store credentials in environment variables or ~/.config/twitter/credentials.json:

bash
export TWITTER_API_KEY="your-api-key"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

Credentials

Store credentials in environment variables or ~/.config/twitter/credentials.json:

bash
export TWITTER_API_KEY="your-api-key"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/tweet.py (reported line 52)May include surrounding context.

python
### Credentials

Store credentials in environment variables or `~/.config/twitter/credentials.json`:

```bash
export TWITTER_API_KEY="your-api-key"

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill documents access to environment variables containing Twitter credentials but does not declare any tool scope or allowed-tools constraints. In an agent environment, this weakens least-privilege controls and can enable unintended access to secrets or broader execution capabilities than users expect.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
83% confidence
Finding

The documentation encourages persistent storage of long-lived Twitter credentials in a local plaintext JSON file under the user's home directory. Even with restrictive permissions, persistent secret storage increases exposure to local compromise, backups, agent overreach, or accidental reuse across sessions.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

export TWITTER_BEARER_TOKEN="your-bearer-token" # For read-only operations

text

Or create credentials file:

```bash
mkdir -p ~/.config/twitter

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

"bearer_token": "your-bearer-token" } EOF chmod 600 ~/.config/twitter/credentials.json

text

### Install Dependencies

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill provides commands for posting tweets and sending DMs without clearly warning that these actions create outbound communications, including public posts and direct messages under the user's account. This increases the risk of accidental social-media actions, reputational harm, or unintended contact with third parties.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code sends a DM via the X/Twitter API, which transmits user-provided content to an external network service. Although the command name implies messaging, there is no confirmation prompt or explicit disclosure near the operation warning that the content will be sent immediately to the recipient/platform.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The document presents lang:en as the default English-language operator example, and later reuses lang:en in sample queries. This can encourage English-only behavior without offering a language choice or clarifying that users should select the locale that matches their needs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The example query includes lang:en, which constrains results to English without any accompanying guidance that the language should be user-selected. Because this is natural-language documentation, such examples can implicitly standardize English-only searches in a way that conflicts with language-choice expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This example query filters to lang:en without documenting that other language codes may be more appropriate depending on the user's locale or preference. That creates an avoidable language/locale bias in the instructional examples.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The function reads sensitive API credentials from environment variables and from ~/.config/twitter/credentials.json. While this is part of authentication, the file does not provide a visible user-facing warning or disclosure that sensitive local credentials will be accessed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.