ClawHub
Back to skill

Security audit

X OAuth API

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a real X posting client, but its declared scope conflicts with implemented search, mentions, and automation behavior for a live social account.

Review this before installing. Use a dedicated X app or low-risk account, keep the OAuth tokens private, and do not let an agent run posting, deletion, mentions, search, or automation commands unless you explicitly intend those live account actions. Treat delete as irreversible and review generated tweet content before running the automation template.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (22)

Credential Access

High
Category
Privilege Escalation
Content
3. Generate OAuth 1.0a keys:
   - Consumer Key (API Key)
   - Consumer Secret (API Secret)
   - Access Token
   - Access Token Secret

### 2. Set Environment Variables
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
3. Generate OAuth 1.0a keys:
   - Consumer Key (API Key)
   - Consumer Secret (API Secret)
   - Access Token
   - Access Token Secret

### 2. Set Environment Variables
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
3. Generate OAuth 1.0a keys:
   - Consumer Key (API Key)
   - Consumer Secret (API Secret)
   - Access Token
   - Access Token Secret

### 2. Set Environment Variables
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
3. Generate OAuth 1.0a keys:
   - Consumer Key (API Key)
   - Consumer Secret (API Secret)
   - Access Token
   - Access Token Secret

### 2. Set Environment Variables
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The README advertises `mentions` and `search` commands even though the skill metadata explicitly says the skill is not for search or mentions. This mismatch can cause users or upstream agents to invoke capabilities outside the declared scope, undermining trust boundaries, policy enforcement, and safe tool selection.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The manifest says the skill is not for search, mentions, or media uploads, but the body advertises commands for mentions, search, and media attachment. This mismatch can cause an agent or user to invoke capabilities that exceed the stated trust boundary, leading to unintended data access or policy bypass.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The manifest says the skill is not for search, mentions, or media uploads, but the body advertises commands for mentions, search, and media attachment. This mismatch can cause an agent or user to invoke capabilities that exceed the stated trust boundary, leading to unintended data access or policy bypass.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The manifest explicitly says the skill is not for search, mentions, or media uploads, yet the documentation instructs users to use mentions, search, and media-post features. Such self-contradiction is dangerous because security decisions often rely on the manifest summary, while the operational text encourages broader, potentially privacy-impacting actions.

Credential Access

High
Category
Privilege Escalation
Content
- **"Unauthorized" after credential rotation** — X API keys are invalidated when you regenerate them in the Developer Portal. All 4 env vars must be updated together (`X_API_KEY`, `X_API_SECRET`, `X_ACCESS_TOKEN`, `X_ACCESS_TOKEN_SECRET`).
- **Trailing newlines in env vars break auth** — If you copy/paste credentials and include a trailing `\n`, OAuth signing will fail silently with a 401. Always verify with `echo -n "$X_API_KEY" | xxd` to confirm no whitespace.
- **Rate limit 429s are per-endpoint** — Hitting the limit on `POST /2/tweets` doesn't affect `GET /2/users`. Each endpoint has its own 15-minute window. Back off only the failing endpoint.
- **App write permissions must be set before generating tokens** — If you generate access tokens before enabling "Read and Write" in the Developer Portal, the tokens will be read-only. Regenerate tokens after changing permissions.
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The manifest says the skill is not for mentions, yet the implementation includes a `mentions` command that retrieves the authenticated user's mention timeline. This hidden capability undermines trust boundaries and can expose account-related data or enable agent behavior beyond what reviewers, users, or policy systems expect from the skill description.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The skill metadata explicitly says it is not for search, but the code exposes a functional `search` command that performs tweet searches via the X API. This is a capability mismatch that can bypass policy or operator expectations, causing the agent to perform actions outside its declared scope and potentially access data or paid-tier endpoints the user did not authorize in the skill definition.

Credential Access

High
Category
Privilege Escalation
Content
console.log(`  Following: ${user.public_metrics.following_count || 0}`);
        console.log(`  Tweets: ${user.public_metrics.tweet_count || 0}`);
      }
      console.log(`\n  X_USER_ID=${user.id} (add this to your .env for faster mentions)`);
    } catch (error) {
      console.error('❌ Failed to fetch account info:', error.message);
      process.exit(1);
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The README documents public account-affecting actions such as posting, threading, deletion, and automation templates without an explicit warning that these actions are irreversible or publicly visible on the user's account. In agentic contexts, missing safety disclosure increases the risk of accidental unauthorized or surprising actions triggered by ambiguous user prompts or automation.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill declares required environment-variable access but does not define an explicit tool scope or permission boundary. That weakens least-privilege controls and makes it easier for a runtime or agent to grant broader access than users may expect, especially since the skill operates with live social-media credentials.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The overview presents mentions and search as available use cases while later text states these require a higher X API tier. This inconsistency can mislead agents into attempting unsupported calls, causing failed actions, noisy retries, or accidental exposure of account-linked identifiers when checking mentions.

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The documentation advertises media posting via a --media option despite also stating media uploads are unsupported or require a higher tier. This can prompt users or agents to attempt operations the skill cannot safely or correctly perform, increasing the chance of unexpected behavior or insecure workarounds.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill documents tweet deletion without any warning, dry-run mode, or confirmation guidance. Because deletion is destructive and operates against a live account, an agent misunderstanding or prompt injection could irreversibly remove content the user did not intend to delete.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The file implements an automated posting template with daily limits and cooldowns, which materially differs from the manifest’s description of a user-invoked helper for posting and account actions. This mismatch is dangerous because users or orchestrators may grant the skill broader trust than intended, causing unattended social-media actions and policy/compliance issues.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The manifest claims the skill should be used to create threads, delete tweets, and check account info. This script only generates one post string and calls a post action; there is no code path for thread creation, deletion, or account-information retrieval in this file.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"author": "",
  "license": "MIT",
  "dependencies": {
    "twitter-api-v2": "^1.15.0",
    "commander": "^11.1.0",
    "dotenv": "^16.3.1"
  },
Confidence
94% confidence
Finding
The dependency uses a caret range, which allows newer minor/patch releases to be installed without explicit review. This increases supply-chain risk because a compromised upstream release or breaking change could be pulled into the skill automatically, which is relevant here because the package handles OAuth-based posting to a social-media account.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"license": "MIT",
  "dependencies": {
    "twitter-api-v2": "^1.15.0",
    "commander": "^11.1.0",
    "dotenv": "^16.3.1"
  },
  "engines": {
Confidence
94% confidence
Finding
The commander package is specified with a caret range, so future compatible releases may be installed implicitly. While this is common in JavaScript projects, it still creates a low-severity supply-chain exposure if an upstream package release is malicious or unexpectedly changes CLI argument handling.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"dependencies": {
    "twitter-api-v2": "^1.15.0",
    "commander": "^11.1.0",
    "dotenv": "^16.3.1"
  },
  "engines": {
    "node": ">=16.0.0"
Confidence
94% confidence
Finding
The dotenv dependency is not pinned exactly, allowing unreviewed patch/minor updates to be resolved at install time. In a skill that likely loads API credentials from environment files, any supply-chain compromise in this package could affect secret handling or execution flow.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
bin/x.js:27