Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a real xAI/Grok integration, but it needs review because it sends user content to xAI, uses broad credential fallbacks, and includes guidance for platform and AI-detection avoidance.
Review before installing. Use it only if you are comfortable sending prompts, queries, images or screenshots, draft posts, X URLs, and public account analysis targets to xAI using an API key that may be read from environment variables or local Clawdbot config, including related skill entries. Avoid using the voice and post-optimization workflows for impersonation, deceptive content, spam, or evading platform safeguards.
The skill invokes Node scripts that use environment variables and external network access, but it does not declare an explicit tool scope such as allowed-tools or permissions. This weakens least-privilege controls and can let the runtime grant broader capabilities than users or orchestrators expect, especially for a skill that sends prompts, images, and search queries to third-party services.
The trigger list includes broad phrases like 'grok', 'xai', 'search x', 'search twitter', and 'x trends', which can match ordinary user requests and auto-activate the skill unexpectedly. Because this skill performs external searches and transmits user-provided content to third-party services, overbroad routing increases the chance of unintended data exposure or tool execution.
The skill documentation directs users to send prompts, searches, images, and X content to xAI and web-search services, but it does not prominently warn that this data leaves the local environment and is shared with third parties. In a skill handling free-form prompts and image inputs, missing disclosure can cause accidental transmission of sensitive, proprietary, or personal information.
The voice-analysis prompt instructs collection and analysis of another account's recent posts without any privacy, consent, or acceptable-use warning. Even if the content is public, packaging this as a workflow for profiling a person's 'voice' increases misuse risk for impersonation, targeted manipulation, or unconsented behavioral analysis.
The post-safety workflow asks users to submit draft text or fetch post content for analysis, but it does not warn that this content may be sent to external services or APIs. That omission can lead users to disclose unpublished drafts, sensitive campaign material, or third-party content without informed consent or appropriate data handling expectations.
Taken together, the post-safety scoring, AI-signal detection, 'missing human signals,' and optimization guidance create a workflow for making generated or manipulative content appear more human while improving reach. This cumulative design meaningfully lowers the barrier to deceptive content laundering and platform-evasion at scale.
This section goes beyond neutral analysis and provides concrete advice for manipulating X ranking signals, such as maximizing reply loops, timing posts around diversity decay, and minimizing negative feedback. In a skill whose purpose includes content analysis, that guidance materially enables algorithm-gaming and can be abused for spammy or deceptive growth tactics.
The script reads secrets and configuration not only from its own skill entry but also from unrelated local Clawdbot skill entries such as xai, grok-search, and search-x. That broad fallback behavior creates unnecessary credential/config harvesting capability and violates least-privilege, increasing the chance that a user’s unrelated API keys are silently reused or exposed through this skill’s execution path.
The script sends user-provided post text, account handles, topic queries, and potentially fetched X post content to xAI’s external API without any explicit warning, consent prompt, or redaction step. This is dangerous because users may provide drafts, research topics, or account-analysis targets they assume remain local, causing unintended disclosure of sensitive or proprietary content to a third party.
This code performs a network POST to xAI’s responses endpoint containing the assembled prompt, which includes user-supplied content and analysis targets. External transmission is expected for a cloud AI integration, but it remains a real data-exposure risk when the tool does not minimize, warn about, or gate what is being sent.
temperature: 0,
};
const res = await fetch("https://api.x.ai/v1/responses", {
method: "POST",
headers: {
"Content-Type": "application/json",
This code performs a network POST to xAI’s responses endpoint containing the assembled prompt, which includes user-supplied content and analysis targets. External transmission is expected for a cloud AI integration, but it remains a real data-exposure risk when the tool does not minimize, warn about, or gate what is being sent.
temperature: 0,
};
const res = await fetch("https://api.x.ai/v1/responses", {
method: "POST",
headers: {
"Content-Type": "application/json",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
store: false,
};
const res = await fetch("https://api.x.ai/v1/responses", {
method: "POST",
headers: {
"Content-Type": "application/json",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
store: false,
};
const res = await fetch("https://api.x.ai/v1/responses", {
method: "POST",
headers: {
"Content-Type": "application/json",
The script sends the full prompt and any attached images to xAI's external API but provides no runtime warning or confirmation to the user. In a CLI used for research or analysis, this can cause accidental disclosure of sensitive text, local image content, or proprietary data to a third party.
This code reads an API key from environment variables and local configuration, then later uses it in an authenticated network request to xAI. While the file has internal comments describing lookup priority, it does not provide a user-facing warning, confirmation, or explicit disclosure that credentials will be read from ~/.clawdbot/clawdbot.json and sent to an external service.
The script constructs a prompt from the supplied query and sends it to https://api.x.ai/v1/responses. Although the tool's purpose is search, the file does not include a clear user-facing disclosure in usage text or output that the provided query content will be transmitted to a third-party service.
The script harvests an xAI API key from a broad set of entries in a local ~/.clawdbot/clawdbot.json file, including unrelated skills, even though its stated purpose is only to list available xAI models. This expands the script's access to secrets beyond explicit user intent and creates a cross-skill credential access path, which is dangerous in an agent/skill ecosystem because a seemingly simple utility can silently consume secrets from other configurations.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
let data;
try {
data = await fetchJson("https://api.x.ai/v1/language-models");
} catch {
data = await fetchJson("https://api.x.ai/v1/models");
}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
let data;
try {
data = await fetchJson("https://api.x.ai/v1/language-models");
} catch {
data = await fetchJson("https://api.x.ai/v1/models");
}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
let data;
try {
data = await fetchJson("https://api.x.ai/v1/language-models");
} catch {
data = await fetchJson("https://api.x.ai/v1/models");
}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
let data;
try {
data = await fetchJson("https://api.x.ai/v1/language-models");
} catch {
data = await fetchJson("https://api.x.ai/v1/models");
}
The vision examples encourage users to pass local images and screenshots to an external xAI model without any privacy or data-handling warning. In this skill's context, screenshots may contain source code, credentials, internal dashboards, or personal data, so omission of an explicit disclosure can lead to accidental exfiltration of sensitive information to a third-party service.
This markdown file includes operational advice to 'Cache results locally' when handling rate limits, but it does not mention any privacy or data-retention implications of storing retrieved search data on the user's system. Because SQP-2 applies to markdown files when behaviors could affect user data or privacy, this omission merits a warning finding.
The manifest describes search, chat, and analysis capabilities for X/web content via xAI's API. This section instead gives operational guidance on posting volume, reach, reply loops, and avoiding spam/shadowban, which is content distribution strategy rather than search/chat/analysis behavior.
The script pulls credentials and model settings from a global ~/.clawdbot configuration and even from multiple unrelated skill entries. This creates cross-skill secret reuse and implicit trust boundaries, so one skill can consume credentials intended for another integration without explicit user consent, increasing the risk of accidental secret misuse and unintended account/API access.
Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal