X Thread Reader

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

A public tweet/thread ID is sent to a third-party service, and PDF mode can create or overwrite a local PDF file at the chosen path.

Why it was flagged

The script sends the tweet ID to twitter-thread.com and, in PDF mode, can drive a local browser to create a PDF. This is disclosed and aligned with the skill purpose, but users should notice the network call and file creation.

Skill content

HTML=$(curl -sL --max-time 30 "$PDF_PAGE_URL") ... "$CHROME" --headless --print-to-pdf="$OUTPUT"

Recommendation

Use it only for threads you are comfortable sending to twitter-thread.com, and choose a safe output path when generating PDFs.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill may fail or use whichever local browser/tool is available if these dependencies are missing or unexpected.

Why it was flagged

The skill relies on local tools, while the registry requirements list no required binaries and there is no install spec. This is a metadata completeness issue rather than hidden behavior.

Skill content

zero dependencies beyond `curl` and `python3` ... PDF mode: Uses Chrome headless (`--print-to-pdf`) or `agent-browser`

Recommendation

Declare curl, python3, and the optional PDF-generation tools in metadata, and review the included script before use.