Security audit
Security checks for vulnerabilities and agentic risk
This X API skill is mostly coherent, but it stores powerful account tokens in local plaintext files and can read private bookmarks or post publicly without strong safeguards.
Install only if you are comfortable granting this skill X API access that may include private bookmarks and public posting. Use a least-privilege X app if possible, set spending limits, restrict ~/.openclaw/x permissions to owner-only, keep the JSON files out of backups and repositories, and manually confirm any post text before running the post command.
scripts/x.py:62Credential and OAuth token files are created without restrictive permissions
scripts/x.py:264OAuth callback uses a predictable state value and does not validate it
The guide instructs users to place a live bearer token in a plaintext JSON file under the home directory. While this is common setup guidance, storing reusable API credentials unencrypted on disk increases the risk of credential theft by other local users, malware, backups, or accidental disclosure.
mkdir -p ~/.openclaw/x
cat > ~/.openclaw/x/credentials.json <<EOF
{
"bearer_token": "YOUR_BEARER_TOKEN_HERE",
"consumer_key": "OPTIONAL",
The documented file structure explicitly identifies several local files that contain bearer, client, and user OAuth tokens. That centralization of plaintext secrets is operationally convenient but increases exposure if the workstation, shell environment, or backups are compromised.
~/.openclaw/x/
├── credentials.json # Bearer token (required)
├── oauth2.json # OAuth client creds (optional)
└── tokens.json # OAuth user tokens (auto-generated)
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
---
name: x
version: 1.0.0
description: "Access X (Twitter) via API v2: user profiles, timelines, threads, search, bookmarks, likes, and posting. Use when asked to: (1) get user info or profile, (2) fetch someone's tweets/timeline, (3) extract conversation threads, (4) search for tweets about a topic, (5) retrieve bookmarks, (6) get liked tweets, (7) post tweets, or (8) lookup tweets by ID or URL."
summary: "X (Twitter) API v2 client — profiles, timelines, search, bookmarks, posting."
metadata:
openclaw:
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
python3 {baseDir}/scripts/x.py search "OpenClaw" --max 100
**Extract threads:**
```bash
# Get full thread for analysis
python3 {baseDir}/scripts/x.py thread <tweet_url> > thread.txt
The documentation explicitly directs users to create a plaintext credentials file containing a bearer token. This creates a real credential-exposure risk because bearer tokens are reusable secrets that can grant API access if read by other local users, malware, backups, logs, or accidentally shared files.
# 1. Create credentials file
mkdir -p ~/.openclaw/x
cat > ~/.openclaw/x/credentials.json <<EOF
{
"bearer_token": "YOUR_BEARER_TOKEN_HERE"
}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
from datetime import datetime
CONFIG_DIR = os.path.expanduser("~/.openclaw/x")
CREDS_FILE = os.path.join(CONFIG_DIR, "credentials.json")
OAUTH2_FILE = os.path.join(CONFIG_DIR, "oauth2.json")
TOKENS_FILE = os.path.join(CONFIG_DIR, "tokens.json")
API_BASE = "https://api.x.com/2"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
from datetime import datetime
CONFIG_DIR = os.path.expanduser("~/.openclaw/x")
CREDS_FILE = os.path.join(CONFIG_DIR, "credentials.json")
OAUTH2_FILE = os.path.join(CONFIG_DIR, "oauth2.json")
TOKENS_FILE = os.path.join(CONFIG_DIR, "tokens.json")
API_BASE = "https://api.x.com/2"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
from datetime import datetime
CONFIG_DIR = os.path.expanduser("~/.openclaw/x")
CREDS_FILE = os.path.join(CONFIG_DIR, "credentials.json")
OAUTH2_FILE = os.path.join(CONFIG_DIR, "oauth2.json")
TOKENS_FILE = os.path.join(CONFIG_DIR, "tokens.json")
API_BASE = "https://api.x.com/2"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def refresh_access_token():
"""Refresh OAuth access token using refresh_token."""
import time
import base64
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
expires_at = issued_at + expires_in
if time.time() >= expires_at - 60: # Refresh 60s before expiry
print("🔄 Access token expired, refreshing...", file=sys.stderr)
tokens = refresh_access_token()
token = tokens.get("access_token")
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
1. **Go to Developer Portal**
<https://developer.x.com/en/portal/projects-and-apps>
2. **Create or select an app**
- Click "Create App" or select existing
- Fill in required fields (name, description)
The OAuth setup instructs users to save a client secret to a local file and later persist OAuth user tokens, including offline access. Persistent long-lived credentials materially increase the blast radius if the host is compromised, especially because the skill supports posting and accessing private account data like bookmarks.
Save and copy credentials
After saving, you'll see Client ID and Client Secret.
Create OAuth credentials file
cat > ~/.openclaw/x/oauth2.json <<EOF
The skill advertises capabilities that perform network access and can write files via shell redirection examples, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a governance gap: an agent framework may permit broader execution than intended, increasing the chance of unauthorized outbound requests or local data writes when the skill is invoked.
The skill supports posting tweets but does not clearly warn that this is a public, externally visible, and effectively irreversible action. In an agent setting, missing confirmation language can lead to accidental posts, reputational harm, disclosure of sensitive information, or unintended actions taken on behalf of the user.
The setup instructions tell users to place a bearer token in ~/.openclaw/x/credentials.json but provide no guidance on file permissions, token sensitivity, rotation, or avoiding accidental disclosure. While storing API credentials locally is common, omitting basic secret-handling warnings in a quickstart can lead to credential leakage through backups, screenshots, shared home directories, or source control mistakes.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# 1. Create credentials file
mkdir -p ~/.openclaw/x
cat > ~/.openclaw/x/credentials.json <<EOF
{
The quickstart advertises x.py post "Hello world!" alongside read-only commands without any explicit warning that this action publishes content to the user's X account. In an agent skill context, mixing state-changing actions into a terse quick reference increases the risk of unintended public posting, especially if a user or downstream agent treats all examples as safe to run.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
CREDS_FILE = os.path.join(CONFIG_DIR, "credentials.json")
OAUTH2_FILE = os.path.join(CONFIG_DIR, "oauth2.json")
TOKENS_FILE = os.path.join(CONFIG_DIR, "tokens.json")
API_BASE = "https://api.x.com/2"
REDIRECT_URI = "http://localhost:8080/callback"
SCOPES = ["tweet.read", "users.read", "bookmark.read", "tweet.write", "offline.access"]
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
CREDS_FILE = os.path.join(CONFIG_DIR, "credentials.json")
OAUTH2_FILE = os.path.join(CONFIG_DIR, "oauth2.json")
TOKENS_FILE = os.path.join(CONFIG_DIR, "tokens.json")
API_BASE = "https://api.x.com/2"
REDIRECT_URI = "http://localhost:8080/callback"
SCOPES = ["tweet.read", "users.read", "bookmark.read", "tweet.write", "offline.access"]
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
CREDS_FILE = os.path.join(CONFIG_DIR, "credentials.json")
OAUTH2_FILE = os.path.join(CONFIG_DIR, "oauth2.json")
TOKENS_FILE = os.path.join(CONFIG_DIR, "tokens.json")
API_BASE = "https://api.x.com/2"
REDIRECT_URI = "http://localhost:8080/callback"
SCOPES = ["tweet.read", "users.read", "bookmark.read", "tweet.write", "offline.access"]
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
CREDS_FILE = os.path.join(CONFIG_DIR, "credentials.json")
OAUTH2_FILE = os.path.join(CONFIG_DIR, "oauth2.json")
TOKENS_FILE = os.path.join(CONFIG_DIR, "tokens.json")
API_BASE = "https://api.x.com/2"
REDIRECT_URI = "http://localhost:8080/callback"
SCOPES = ["tweet.read", "users.read", "bookmark.read", "tweet.write", "offline.access"]
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
CREDS_FILE = os.path.join(CONFIG_DIR, "credentials.json")
OAUTH2_FILE = os.path.join(CONFIG_DIR, "oauth2.json")
TOKENS_FILE = os.path.join(CONFIG_DIR, "tokens.json")
API_BASE = "https://api.x.com/2"
REDIRECT_URI = "http://localhost:8080/callback"
SCOPES = ["tweet.read", "users.read", "bookmark.read", "tweet.write", "offline.access"]
OAuth access and refresh tokens are persisted to disk in a predictable location without setting restrictive filesystem permissions or warning the user that long-lived credentials will be stored locally. On multi-user systems or where home-directory contents are backed up, synced, or exposed, these tokens could be recovered and used to access the user's X account and private data.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
auth_header = f"Basic {base64.b64encode(credentials).decode()}"
token_req = urllib.request.Request(
"https://api.twitter.com/2/oauth2/token",
data=token_body,
headers={
"Content-Type": "application/x-www-form-urlencoded",
The bookmarks command retrieves inherently private bookmark data and can print full raw JSON or extracted URLs directly to stdout without any privacy warning, redaction, or confirmation. In agent or shared-shell contexts, this increases the risk of accidental disclosure into logs, transcripts, terminal history capture, or downstream tooling.
No suspicious patterns detected.