ClawHub
Back to skill

Security audit

Search X

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward X/Twitter search helper that sends user search terms to xAI and uses an API key for that purpose.

Install only if you are comfortable sending X/Twitter search terms, date filters, and handle filters to xAI. Keep the xAI API key private, and review the local config lookup if you do not want skills reading ~/.clawdbot/clawdbot.json for credentials.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill declares use of environment-based secrets via `XAI_API_KEY` but does not define an explicit tool/permission scope such as `permissions` or `allowed-tools`. That weakens least-privilege controls and makes the skill's runtime capabilities less transparent to users and hosting frameworks, increasing the risk of unintended secret access or broader execution than expected.

Shadow Command Trigger

Medium
Category
Trigger Abuse
Confidence
84% confidence
Finding
The trigger `search x` overlaps with a built-in `search` command namespace, which can cause the skill to intercept or ambiguously match requests intended for trusted built-in functionality. This can redirect user queries to different execution logic and, in this skill's case, may send data to an external API when the user expected a local or default search path.

Shadow Command Trigger

Medium
Category
Trigger Abuse
Confidence
84% confidence
Finding
The trigger `search twitter` similarly conflicts with the generic built-in `search` command family and may capture user intent ambiguously. Because this skill forwards queries to an external provider, the conflict increases the chance of unintended off-box transmission and unexpected behavior.

Shadow Command Trigger

Medium
Category
Trigger Abuse
Confidence
78% confidence
Finding
The trigger `find tweets` conflicts with the generic built-in `find` command space, creating ambiguity about whether the platform should invoke built-in discovery behavior or this skill. Ambiguous trigger routing can cause user requests to be handled by an unintended component and may expose search terms to external services unexpectedly.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill sends user search queries to xAI's external `/v1/responses` API, but the description does not clearly warn that user-provided terms leave the local environment. This creates a privacy and data-handling risk because users may unknowingly submit sensitive prompts, internal project names, or personal data to a third party.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The script retrieves credentials not only from the explicit XAI_API_KEY environment variable but also from a local ~/.clawdbot/clawdbot.json file. That broader secret access is more capability than is strictly necessary for a simple search utility, and it increases the chance of unintended credential use or cross-skill secret exposure if users do not realize the script will read local config automatically.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script sends the user's query and search constraints to api.x.ai, but the CLI interface does not clearly disclose that input will be transmitted to a third-party service at execution time. In a search skill this network use is expected, but the missing explicit notice can still lead to accidental sharing of sensitive prompts, internal project names, or other confidential terms.

Missing User Warnings

Low
Confidence
95% confidence
Finding
The markdown file tells users to set `XAI_API_KEY` via an environment variable, which involves handling sensitive credentials. There is no accompanying warning about keeping the key secret, avoiding committing it to shell history or shared config files, or otherwise protecting it.

Static analysis

No suspicious patterns detected.