Security checks for vulnerabilities and agentic risk
Overview
This is a straightforward X posting skill, but users should understand it uses write-capable X credentials and a live posting command.
Install only if you are comfortable giving this skill write access to an X account. Use a dedicated or low-risk X app/token, review posts before running the command, avoid global npm installation, and prefer pinned dependencies with a lockfile.
Related installation instructions appear in README.md:33-36:
bash
cd ~/.clawdbot/skills/x-api/scripts
npm install
SKILL.md:47-51 also recommends a global installation:
bash
npm install -g twitter-api-v2
Technical Analysis
The dependency uses the mutable semantic-version range ^1.19.0, which permits npm to install later compatible releases. The project does not include a package lockfile or other integrity metadata. Therefore, dependency resolution and installed code can change after the skill has been reviewed.
An npm installation may also execute dependency lifecycle scripts with the privileges of the user running npm. The documented global installation increases the affected scope by installing the package outside the project-local dependency tree.
This is a supply-chain weakness rather than evidence that the currently declared package is malicious. Exploitation requires compromise or malicious replacement of a dependency version accepted by the range, registry resolution, or the package maintainer's publishing credentials.
Attack Path
An attacker compromises the dependency's publishing account, registry delivery path, or another package in the resolved dependency tree.
The attacker publishes or serves a malicious release compatible with ^1.19.0.
A user follows the documentation and runs npm install or npm install -g twitter-api-v2.
Because no lockfile and integrity-pinned dependency graph are present, npm resolves and downloads the changed package.
Malicious code can execute through an npm lifecycle script during installation or when x-post.mjs imports and uses the dependency.
At runtime, the malicious dependency m
...[truncated 918 chars]
Remediation
View remediation
Remediation Suggestions
Replace the caret range with an exact, reviewed dependency version:
json
"twitter-api-v2": "1.19.0"
Generate, review, and commit package-lock.json so that the complete dependency graph and package integrity hashes are recorded.
Update the installation documentation to require reproducible local installation with npm ci rather than npm install.
Remove the recommendation to install twitter-api-v2 globally. Keep the dependency scoped to the skill directory.
Where package compatibility permits, install with lifecycle scripts disabled:
bash
npm ci --ignore-scripts
If lifecycle scripts are required, review them before installation.
Regularly audit direct and transitive dependencies, review lockfile changes during upgrades, and use automated vulnerability and provenance checks.
Run installation and execution as an unprivileged user with access limited to the credential file and resources required by the skill.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
md
4. Get your keys from "Keys and tokens" tab:
- API Key (Consumer Key)
- API Key Secret (Consumer Secret)
- Access Token
- Access Token Secret
### 2. Configure Credentials
Credential Access
High
Category
Privilege Escalation
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.
md
4. Get your keys from "Keys and tokens" tab:
- API Key (Consumer Key)
- API Key Secret (Consumer Secret)
- Access Token
- Access Token Secret
### 2. Configure Credentials
Credential Access
High
Category
Privilege Escalation
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.
md
4. Get your keys from "Keys and tokens" tab:
- API Key (Consumer Key)
- API Key Secret (Consumer Secret)
- Access Token
- Access Token Secret
### 2. Configure Credentials
Credential Access
High
Category
Privilege Escalation
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · scripts/x-post.mjs (reported line 79)May include surrounding context.
js
try {
const { data } = await client.v2.tweet(text);
// Get username from the access token (first part before the dash is user ID)
const userId = credentials.accessToken.split('-')[0];
console.log(`✅ Posted: https://x.com/i/status/${data.id}`);
} catch (err) {
Session Persistence
Medium
Category
Rogue Agent
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content
Scanner excerpt · README.md (reported line 21)May include surrounding context.
md
The X API isn't free:
- **Free tier**: 1,500 posts/month, but requires credits (pay-as-you-go)
- **Basic tier**: $100/month for higher limits
- You need to create a Developer account and app at [developer.x.com](https://developer.x.com)
## Installation
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
The README tells users how to invoke a script that posts to X but does not clearly warn that executing the command will publish content publicly from the user's own account. In an agent-skill context, this can lead to unintended real-world actions, reputational harm, or accidental posting of sensitive or unreviewed content if a user or agent runs the command without explicit confirmation.
Content
No source excerpt is available for this finding.
Undeclared Tool Scope
Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill documents use of environment variables and local secret files to access X API credentials, but it does not declare an explicit permission or allowed-tools scope for environment access. That creates an authorization ambiguity where an agent may access sensitive credentials without a clearly declared boundary, increasing the chance of unintended secret use.
Content
No source excerpt is available for this finding.
Session Persistence
Medium
Category
Rogue Agent
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content
Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.
md
### 1. Get API Credentials
1. Go to https://developer.x.com/en/portal/dashboard
2. Create a Project and App
3. Set App permissions to **Read and Write**
4. Get your keys from "Keys and tokens" tab:
- API Key (Consumer Key)
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
The skill provides a posting command and examples but does not clearly warn that invoking it will publish content to a real X account. In an agent setting, this can lead to accidental live posting, reputational harm, spam, or policy violations because the action is irreversible and externally visible.
Content
No source excerpt is available for this finding.
Session Persistence
Medium
Category
Rogue Agent
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content
Scanner excerpt · scripts/x-post.mjs (reported line 52)May include surrounding context.
This code performs an external API call that publishes user-supplied text to a third-party service, which is a safety-relevant network operation. Although success and failure are logged afterward, there is no prior confirmation prompt or explicit pre-action disclosure in the file before the post is sent.
Content
No source excerpt is available for this finding.
Unpinned Dependencies
Low
Category
Supply Chain
Confidence
91% confidence
Finding
The dependency uses a caret range (^1.19.0), which permits automatic installation of newer 1.x releases rather than a single vetted version. This creates supply-chain risk because future upstream releases could introduce vulnerable or malicious code without a corresponding review or lockstep update in this skill.
Content
Scanner excerpt · scripts/package.json (reported line 6)May include surrounding context.
The manifest describes a skill for posting to X via the official API, but does not mention reading secrets from the filesystem. Accessing ~/.clawdbot/secrets/x-api.json and ./.x-api.json adds local file-reading capability beyond the core posting action, even though it is used only for credential discovery.
