X (Twitter) Data Scraper

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:39 AM UTC
• Version: 1.0.1

Overview

This skill mostly matches its X/Twitter scraping purpose, but it asks for and automatically uses sensitive account credentials in ways that are broader than needed and not clearly controlled.

Review this skill carefully before installing. Use a limited X API bearer token rather than an account password, avoid placing credentials or cookies under /root, do not provide a full browser cookie jar unless you intentionally want authenticated scraping, and isolate any browser scraping from your normal logged-in sessions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: CAPABILITY.md:215

Finding

Unnecessary Collection and Plaintext Storage of Full X Account Credentials

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_x_playwright.py:12

Finding

Browser Scraper Automatically Imports a Privileged Full-Session Cookie Jar

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The documentation explicitly identifies a credential file path for X login secrets, indicating the skill depends on direct access to stored authentication material. In an agent environment, exposing or normalizing access to credential files materially raises the risk of credential theft, unauthorized account use, and lateral misuse of authenticated sessions, especially combined with scraping workflows.

Content

Scanner excerpt · CAPABILITY.md (reported line 215)May include surrounding context.

Configuration

Credentials file: /root/.openclaw/credentials/x_login_credentials.env

Required environment variables:

bash

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared behavior says the skill performs X/Twitter scraping and analysis, but the finding indicates the underlying implementation does not actually do those tasks and instead serves some unrelated testing/parsing purpose. This kind of description-behavior mismatch is dangerous because users and orchestrators may grant trust, secrets, or execution rights under false assumptions, enabling deceptive or unintended operations.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/x_api_client.py (reported line 46)May include surrounding context.

python

# Default locations
            possible_paths = [
                Path.home() / '.openclaw' / 'credentials' / 'x_api_tokens.env',
                Path.home() / '.openclaw' / 'credentials' / 'x_credentials.env',
            ]
            for path in possible_paths:
                if path.exists():

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest describes this skill as specifically for X (Twitter) data extraction and analysis, with examples centered on tweets, user timelines, and X search. The capability doc states it searches and scrapes 'social media content (X/Twitter, Reddit, etc.)', which broadens the advertised behavior to other platforms not covered by the skill manifest.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documents authenticated scraping using stored account credentials and cookies, but provides no user-facing warning or constraints around privacy, account ownership, terms-of-service, or data-access implications. In an agent context, this increases the chance of silent collection of non-public or account-scoped data and unsafe automated use of privileged credentials.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The README instructs users to persist a live API bearer token in a plaintext file under ~/.openclaw/credentials without mentioning permission hardening or safer storage options. If that file is readable by other local users, included in backups, or unintentionally exposed by tooling, the token could be stolen and used to access the user's X API quota or data access privileges.

Content

Scanner excerpt · README.md (reported line 42)May include surrounding context.

bash

   export X_BEARER_TOKEN="Bearer YOUR_TOKEN"

Or create ~/.openclaw/credentials/x_api_tokens.env:

text

X_BEARER_TOKEN=Bearer YOUR_TOKEN_HERE

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises scripts that use environment secrets, local credential files, and network access, but it does not declare any explicit tool scope or permissions. In an agent setting, this weakens least-privilege boundaries and can allow broader-than-expected access to secrets, files, or outbound requests if the skill is invoked.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description says to use the skill when the user asks to "search X for" or "analyze Twitter data," which are broad natural-language triggers without clear boundaries or exclusion conditions. These phrases could overlap with ordinary requests and may cause unintended invocation because the file does not define tighter scope or negative examples.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 79% confidence

Finding

The skill instructs users to store a bearer token in a persistent file under the home directory, which creates ongoing secret exposure risk if local files are accessible to other skills, processes, or logs. Persisting API credentials outside a dedicated secret manager increases the chance of token leakage and unauthorized reuse.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

Setup

Credentials: Create ~/.openclaw/credentials/x_api_tokens.env:

text

X_BEARER_TOKEN=Bearer YOUR_TOKEN_HERE

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.publish.md (reported line 29)May include surrounding context.

Setup

Credentials: Create ~/.openclaw/credentials/x_api_tokens.env:

text

X_BEARER_TOKEN=Bearer YOUR_TOKEN_HERE

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The docstring claims an API-related purpose and specifically says it "Bypasses API rate limits," which implies constrained API use. In reality, the code never calls the X/Twitter API; it opens twitter.com pages in Playwright and extracts DOM content, which is a different mechanism and intent than documented.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script silently loads authentication cookies from a fixed path and injects them into a browser context, enabling requests to run under an existing logged-in session without explicit user awareness or consent at runtime. In a skill context, this can expose private account data, perform authenticated scraping, and misuse sensitive credentials if the cookie file belongs to a real user or shared service account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

User-supplied search terms are sent directly to X/Twitter via automated requests with no clear warning that input will be transmitted to an external third party. In an agent skill, users may provide sensitive names, topics, or investigative queries they do not expect to leave the local environment, creating privacy and data-handling risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/x_api_client.py (reported line 19)May include surrounding context.

python

class XAPIClient:
    """X API v2 Client"""
    
    BASE_URL = "https://api.twitter.com/2"
    
    def __init__(self, bearer_token=None, credentials_path=None):
        """

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file presents the core capability description and method descriptions in Chinese, but does not indicate that the skill is Chinese-specific or give users an option to choose language. The policy for natural-language content requires avoiding forced language/locale constraints without opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file instructs users to obtain and store an API bearer token in an environment variable or local credentials file. While it explains how to set the token, it does not include any user warning about the sensitivity of the credential, avoiding committing it to source control, or protecting the local file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

This code performs remote API calls to look up a username and fetch tweet/account metadata, but the function and CLI provide no explicit warning or user-facing notice that network requests will be made and that returned profile data will be emitted to stdout. For a code file, SQP-2 applies when network calls transmitting or retrieving user/system data lack confirmation, logging, or clear explanatory disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.