xAI

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:15 AM UTC
• Version: 1.3.1

Overview

This skill is a purpose-aligned xAI/Grok API wrapper that sends user-provided prompts, searches, and optional images to xAI, with documentation caveats but no hidden persistence or destructive behavior.

Install only if you are comfortable sending prompts, X search queries, and any image passed with --image to xAI's API. Prefer setting XAI_API_KEY explicitly, and be aware that this skill may also use an existing ~/.clawdbot/clawdbot.json xAI API key if present. The broad triggers mean you should invoke it only when you intentionally want Grok/xAI handling the request.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The code generally matches the core declared purpose of chatting with xAI/Grok models through the xAI API, including vision support. However, the description overstates supported capabilities: the code does not implement any real-time X search behavior, and it does not explicitly support or document Grok-4 or Grok-4.20 in the provided implementation. Additionally, while no permissions are declared, the script reads local files: it loads API credentials from ~/.clawdbot/clawdbot.json and reads image files supplied via --image. Those are material resource accesses not reflected in the declared permissions list.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code’s actual purpose is to list available xAI models using the xAI API. It reads an API key from an environment variable or local config file and makes a GET request to /v1/models, then prints model IDs and descriptions. This is materially different from the declared purpose of chatting with Grok models and supporting vision and real-time X search. While model listing may be related to an xAI integration, it does not substantiate the core declared behavior, so this chunk is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The description presents the skill as a broad Grok chat integration with multiple model options, vision, and real-time X search. However, this code chunk only implements a specialized X search CLI using the x_search tool on the xAI Responses API. It builds a prompt instructing the model to find real X/Twitter posts, supports handle/date filtering, and extracts URL citations from the response. There is no general conversational interface, no vision/image handling, and no concrete implementation of the broader multi-model chat behavior claimed in the description. While X search is consistent with part of the declared description, the actual behavior is materially narrower and differently focused, so this is a mismatch.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · scripts/search-x.js (reported line 237)May include surrounding context.

js

--handles <list>        Only search these handles (comma-separated)
  --exclude <list>        Exclude these handles (comma-separated)
  --json, -j              Output full JSON response
  --no-require-citations  Don't warn if no X citations found
  --help                  Show this help

Examples:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 94% confidence

Finding

The trigger phrase 'ask grok' overlaps with the common built-in command pattern 'ask', which can shadow or confuse routing between this skill and existing assistant functionality. Such ambiguity can cause the wrong tool to handle requests, potentially sending sensitive prompts to xAI when the user expected a local or built-in action.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Using the bare trigger 'grok' is overly broad and can cause accidental activation during ordinary conversation about Grok, rather than deliberate invocation of the skill. In an agent environment, unintended activation can send prompts, attached data, or user context to an external API, creating privacy and action-routing risks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger 'xai' is highly generic and may match incidental mentions of the company or API rather than an intentional request to invoke the skill. That increases the chance of unplanned external API calls and unintended disclosure of user prompts or attachments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This script sends user-supplied prompts and optionally entire local image files to xAI's external API, but it provides no explicit warning, consent prompt, or data-handling notice at the point of transmission. In a CLI skill context, users may unintentionally upload sensitive text or local images, especially because the image path is read from disk and converted to base64 automatically before being sent off-host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This code accesses sensitive credentials via process.env.XAI_API_KEY and ~/.clawdbot/clawdbot.json. While this is functionally expected for an API client, there is no explicit disclosure in the help text or inline user-facing messaging that the script will read credentials from these locations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes an xAI/Grok chat skill with X search support, which makes outbound API calls an expected behavior. However, silently reading credentials from ~/.clawdbot/clawdbot.json adds local file access to harvest secrets from another app's config, which is not disclosed by the skill purpose and is not necessary when standard environment-based configuration would suffice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The payload includes the user's query and selected handles, and the script transmits that data to api.x.ai over HTTPS. Although network access is central to the tool's purpose, the user-facing help does not explicitly disclose that search input is sent to an external service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.