ClawHub
Back to skill

Security audit

Tweet Ingest

Security checks for vulnerabilities and agentic risk

Overview

This skill is not self-contained and gives conflicting information about which external services and credentials it uses.

Review this carefully before installing. Only use it if you control and have audited the referenced tweet-ingest.py and rag_index.py scripts, understand whether TwitterAPI.io, Jina AI, Apify, or 1Password credentials are actually used, and are comfortable sending Twitter/X URLs and request data to those services.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T07 · Tool Hijacking and Spoofing

Warning
Location
SKILL.md:33
Finding

Execution of an Unaudited Script Outside the Skill Package

Content
View full analysis
/tmp/tweet.md python3 scripts/rag_index.py /tmp/tweet.md --collection agent-research-kb ``` ```python import subprocess result = subprocess.run( ["python3", "scripts/tweet-ingest.py", url, "--mode", "single"], capture_output=True, text=True ) markdown = result.stdout # Clean markdown, ready to index ``` ### Technical Analysis The Skill package contains only `SKILL.md`; it does not include the referenced `tweet-ingest.py` implementation. The instructions therefore delegate the Skill's core operation to code outside the audited package. The absolute path under `/Users/loki/.openclaw/workspace/scripts/` is tied to one local environment, while the relative `scripts/tweet-ingest.py` path is resolved according to the process working directory. If another user, package, compromised process, or malicious repository can create or modify a script at either resolved location, legitimate-looking Skill invocations will execute that substituted code. Becaus ...[truncated 2792 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill metadata and top-level description say the backend is TwitterAPI.io, but the body documents Jina AI and Apify instead. This kind of backend mismatch is security-relevant because operators and downstream agents may make trust, privacy, billing, and key-management decisions based on incorrect documentation, causing requests and data to be sent to unintended third parties.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description emphasizes convenience but does not clearly disclose that using the skill sends the Twitter/X URL and associated request data to external providers. Because the documented providers are inconsistent, the omission is more dangerous: users and orchestrators cannot accurately assess privacy, compliance, or data residency implications before invocation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The quick-reference examples claim the default single-tweet mode is 'free' and needs no API key, while the manifest declares a required TWITTER_API_KEY and describes TwitterAPI.io as the backend. Contradictory setup and credential guidance can cause agents to invoke the wrong path, mishandle secrets, or unknowingly route data through unexpected services, undermining informed consent and secure operation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The instruction to use this skill whenever a Twitter/X URL appears in conversation is overly broad and can trigger external fetches from casual mentions, quoted content, or untrusted user-supplied URLs without clear need or confirmation. In an agent setting, broad auto-invocation increases the chance of unnecessary data disclosure to third-party services and unintended network actions.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
- You need recent tweets from a specific account for RAG or research
- An agent needs Twitter content without an API key or paid subscription

**Do NOT use for:** sending/posting tweets (use Buffer — `skills/buffer-publisher/SKILL.md`), or monitoring streams in real-time.

---

Static analysis

No suspicious patterns detected.