v1.0.6

X tweet publisher

ReviewClawScan verdict for this skill. Analyzed May 1, 2026, 5:18 AM.

Analysis

This appears to be a straightforward X/Twitter publishing skill, but it can post public content using your account credentials without an explicit approval gate.

GuidanceInstall this only if you are comfortable granting an agent the ability to post publicly to your X account. Before use, set least-privilege credentials, keep them out of shared environments, require per-post confirmation, verify media paths carefully, and consider pinning the Tweepy dependency.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityMediumConfidenceHighStatusConcern

scripts/x_publisher.py

response = client.create_tweet(text=text)

The script directly invokes X's tweet creation API using the configured account. The shown publish path does not include an explicit human confirmation or dry-run step before this public write action.

User impactIf an agent invokes this skill with the configured credentials, it can publish text and media publicly from your X account.

RecommendationUse only if you want the agent to have posting ability. Require explicit approval for every tweet and media path, preview the exact final content before posting, and prefer a dedicated least-privilege X app/account.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

SKILL.md

pip3 install tweepy --user

The dependency install is purpose-aligned, but it is unpinned and not backed by a lockfile or install spec in the provided artifacts.

User impactYou will install whatever Tweepy version pip resolves at setup time, which can vary over time.

RecommendationInstall from a trusted Python package index and consider pinning a known-good Tweepy version in your environment.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityMediumConfidenceHighStatusNote

SKILL.md

export X_API_KEY="your-api-key" ... export X_ACCESS_TOKEN_SECRET="your-access-token-secret"

The skill requires X API credentials and access tokens, which are expected for posting but grant sensitive account authority.

User impactAnyone or anything with access to these environment variables may be able to act through the configured X developer credentials.

RecommendationStore tokens securely, avoid sharing shell environments, use the minimum required X app permissions, and revoke or rotate tokens when no longer needed.