ClawHub
Back to skill

Security audit

Post to X Enhanced

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it can automate real posting through your logged-in X account and has unsafe implementation and disclosure gaps.

Install only if you are comfortable giving this skill control over a real logged-in X session and local browser automation. Use a dedicated Chrome profile, avoid --submit unless you explicitly want live posting, review every post before publishing, do not process untrusted Markdown or media paths, and avoid letting it automatically kill Chrome debugging processes.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/x-utils.ts:256
Finding

Command Injection Through Shell-Enabled Subprocess Execution

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/md-to-html.ts:106
Finding

Server-Side Request Forgery Through Unrestricted Remote Image Downloads

Content
View full analysis
{ return new Promise((resolve, reject) => { if (!url.startsWith('https://')) { reject(new Error(`Refusing non-HTTPS download: ${url}`)); return; } if (maxRedirects <= 0) { reject(new Error('Too many redirects')); return; } const file = fs.createWriteStream(destPath); const request = https.get(url, { headers: { 'User-Agent': 'Mozilla/5.0' } }, (response) => { if (response.statusCode === 301 || response.statusCode === 302) { const redirectUrl = response.headers.location; if (redirectUrl) { file.close(); fs.unlinkSync(destPath); downloadFile(redirectUrl, destPath, maxRedirects - 1).then(resolve).catch(reject); return; } } if (response.statusCode !== 200) { file.close(); fs.unlinkSync(destPath); reject(new Error(`Failed to download: ${response.statusCode}`)); return; } response.pipe(file); file.on('finish', () => { file.close(); resolve(); }); }); request.on('error', (err) => { file.close(); fs.unlink(destPath, () => {}); reject(err); }); request.setTimeout(30000, () => { request.destroy(); reject(new Error('Download timeout')); }); }); } function getImageExtension(urlOrPath: string): string { const match = urlOrPath.match(/\.(jpg|jpeg|png|gif|webp)(\?|$)/i); return match ? match[1]!.toLowerCase() : 'png'; } async function resolveImagePath(imagePath: string, baseDir: string, tempDir: string): Promise { if (imagePath.startsWith('http://')) { console.error(`[md-to-html] Skipping ...[truncated 2660 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/x-article.ts:76
Finding

Predictable Shared Temporary Paths Allow Symlink Overwrite and Cross-Run Tampering

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/package.json:5
Finding

Unpinned Runtime Execution and Dependency Resolution

Content
View full analysis
.ts` 3. Replace all `{baseDir}` in this document with the actual path 4. Resolve `${BUN_X}` runtime: if `bun` installed → `bun`; if `npx` available → `npx -y bun`; else suggest installing bun ``` ```ts function runBunScript(scriptPath: string, args: string[]): boolean { // Try bun directly first (faster, works when bun is globally installed) const bunResult = spawnSync('bun', [scriptPath, ...args], { stdio: 'inherit', shell: true }); if (bunResult.status === 0) return true; // Fallback to npx -y bun const npxResult = spawnSync('npx', ['-y', 'bun', scriptPath, ...args], { stdio: 'inherit', shell: true }); return npxResult.status === 0; } ``` ```json { "name": "baoyu-post-to-x-scripts", "private": true, "type": "module", "dependencies": { "baoyu-chrome-cdp": "file:./vendor/baoyu-chrome-cdp", "front-matter": "^4.0.2", "highlight.js": "^11.11.1", "marked": "^15.0.6", "remark-cjk-friendly": "^1.1.0", "remark-parse": "^11.0.0", "remark-stringify": "^11.0.0", "unified": "^11.0.5" } } ``` ### Technical Analysis The Skill directs the Agent to use `npx -y bun` when Bun is unavailable and repeats that behavior in the subprocess fallback. This permits the package manager to retrieve and execute the currently resolved registry version without interactive approval. The remaining third-party packages use caret ranges, and the audited project contains no lockfile in the provided directory structure. Future installations can therefore resolve package versions different from those reviewed. The l ...[truncated 1435 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (78)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill is framed as social-media posting, but it includes undisclosed OS-level input simulation and app focusing behavior via clipboard/paste helpers. That expands the trust boundary from X posting into desktop automation, which can misdirect input to the wrong window or perform unintended actions on the user's machine.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill is framed as social-media posting, but it includes undisclosed OS-level input simulation and app focusing behavior via clipboard/paste helpers. That expands the trust boundary from X posting into desktop automation, which can misdirect input to the wrong window or perform unintended actions on the user's machine.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill is framed as social-media posting, but it includes undisclosed OS-level input simulation and app focusing behavior via clipboard/paste helpers. That expands the trust boundary from X posting into desktop automation, which can misdirect input to the wrong window or perform unintended actions on the user's machine.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The skill is framed as social-media posting, but it includes undisclosed OS-level input simulation and app focusing behavior via clipboard/paste helpers. That expands the trust boundary from X posting into desktop automation, which can misdirect input to the wrong window or perform unintended actions on the user's machine.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill is framed as social-media posting, but it includes undisclosed OS-level input simulation and app focusing behavior via clipboard/paste helpers. That expands the trust boundary from X posting into desktop automation, which can misdirect input to the wrong window or perform unintended actions on the user's machine.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill is framed as social-media posting, but it includes undisclosed OS-level input simulation and app focusing behavior via clipboard/paste helpers. That expands the trust boundary from X posting into desktop automation, which can misdirect input to the wrong window or perform unintended actions on the user's machine.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill is framed as social-media posting, but it includes undisclosed OS-level input simulation and app focusing behavior via clipboard/paste helpers. That expands the trust boundary from X posting into desktop automation, which can misdirect input to the wrong window or perform unintended actions on the user's machine.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
| `scripts/x-browser.ts` | Regular posts (text + images) |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
| `scripts/x-article.ts` | Long-form article publishing (Markdown) |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md
| `scripts/check-paste-permissions.ts` | Verify environment & permissions |

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/x-quote.ts (reported line 186)May include surrounding context.

ts
seconds for preview...');
      await sleep(30_000);
    }
  } finally {
    let leaveChromeOpen = false;
    if (chrome && loggedInDuringRun && cdp && sessionId) {
      console.log('[x-quote] Waiting for X session cookies to persist...');
      const sessionReady = await waitForXSessionPersistence({ cdp, sessionId });
      if (!sessionReady) {
        console.warn('[x-quote] X session cookies not observed yet. Leaving Chrome open so login can finish persisting.');
        leaveChromeOpen = true;
      }
    }

    if (cdp) {
      if (reusing && targetId) {
        try { await cdp.send('Target.closeTarget', { targetId }, { timeoutMs: 5_000 }); } catch {}
      }
      cdp.close();
    }
    if (chrome) {
      if (leaveChromeOpen) {
        chrome.unref();
      } else {
        await gracefulKillChrome(chrome, port);
      }
    }
  }
}

function printUsage(): never {
  console.log(`Quote a tweet on X (Twitter) using real Chrome browser

Usage:
  n

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/x-video.ts (reported line 193)May include surrounding context.

ts
seconds for preview...');
      await sleep(30_000);
    }
  } finally {
    let leaveChromeOpen = false;
    if (chrome && loggedInDuringRun && cdp && sessionId) {
      console.log('[x-quote] Waiting for X session cookies to persist...');
      const sessionReady = await waitForXSessionPersistence({ cdp, sessionId });
      if (!sessionReady) {
        console.warn('[x-quote] X session cookies not observed yet. Leaving Chrome open so login can finish persisting.');
        leaveChromeOpen = true;
      }
    }

    if (cdp) {
      if (reusing && targetId) {
        try { await cdp.send('Target.closeTarget', { targetId }, { timeoutMs: 5_000 }); } catch {}
      }
      cdp.close();
    }
    if (chrome) {
      if (leaveChromeOpen) {
        chrome.unref();
      } else {
        await gracefulKillChrome(chrome, port);
      }
    }
  }
}

function printUsage(): never {
  console.log(`Quote a tweet on X (Twitter) using real Chrome browser

Usage:
  n

Scope Creep

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest declares an empty permissions set while the description explicitly advertises real browser automation, CDP control, and OS-level scripting via osascript. This creates a capability-transparency gap: reviewers, policy engines, and users may treat the skill as low-privilege even though its documented behavior implies powerful local execution and web interaction capabilities, increasing the risk of abuse or insufficient sandboxing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README describes live posting to X, dialog auto-acceptance, clipboard use, and browser/session automation without prominently warning that the skill will take real actions on the user's authenticated account and interact with an existing Chrome session. This is dangerous because users may invoke the skill expecting draft-like assistance while it can publish content, dismiss safety prompts, and manipulate browser/desktop state with limited opportunity for intervention.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README advertises capabilities beyond the declared scope of simply posting content and articles, including video posting, quote-tweeting, clipboard manipulation, HTML conversion, and permission checking. This mismatch weakens informed consent and reviewability because operators may grant the skill broader trust or permissions than expected, especially given its use of Chrome CDP and OS-level automation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The README instructs users to run npx -y bun without pinning a specific version, which introduces supply-chain risk because the resolved package version can change over time or be replaced if the upstream distribution is compromised. In a skill that automates browser actions against a live social-media session, executing an unpinned runtime materially expands the trust boundary and could lead to arbitrary code execution during installation or use.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding

The skill explicitly instructs the agent to run local scripts, inspect environment state, and automate a browser, but it declares no tool scope or permission boundaries. In practice, this creates an authorization gap where an agent may execute environment- and network-capable actions without clear user-visible constraints or policy enforcement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger phrases are broad everyday terms like 'tweet' or 'share on X', which increases the chance of accidental invocation in contexts where the user did not intend browser automation or local script execution. Unintended activation is especially risky here because the skill can touch local files, clipboard helpers, browser sessions, and shell commands.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

Using npx -y bun without a pinned version allows the runtime artifact fetched at execution time to change unexpectedly, creating a supply-chain risk. An attacker controlling or compromising the upstream package distribution path could cause arbitrary code execution on the host running the skill.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
96% confidence
Finding

The phrase 'without asking' authorizes autonomous local-state changes by the agent, specifically process termination and command retry. Autonomous execution of destructive shell actions reduces human oversight and can amplify mistakes or malicious prompt-triggered behavior.

Content

Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.

pkill -f "Chrome.*remote-debugging-port" 2>/dev/null; pkill -f "Chromium.*remote-debugging-port" 2>/dev/null; sleep 2

text

**Important**: This should be done automatically — when encountering this error, kill Chrome CDP instances and retry the command without asking the user.

## Notes

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The troubleshooting section instructs the agent to automatically kill Chrome instances using remote debugging, despite repeated claims that the skill only prepares content for manual review. Terminating user browser processes can interrupt unrelated sessions, cause data loss, and crosses from benign composition into destructive local process control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The instructions direct automatic termination of Chrome debugging instances without user warning or confirmation. Any skill that can kill local processes without consent introduces a disruptive and potentially destructive action surface on the host system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest promotes automated publishing to X but does not warn that it performs live account actions on behalf of the user. Because this skill can post text and media through browser automation, missing safety disclosure and confirmation language materially increases the risk of accidental, unauthorized, or reputation-damaging posts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation states that remote images are automatically downloaded to a local temp directory, but it does not clearly warn users about the privacy and security implications of fetching attacker-controlled URLs during article processing. This can expose the user's IP address and environment to third parties, trigger downloads of untrusted content onto disk, and create unexpected network side effects during what appears to be a local markdown publishing workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The workflow relies on launching Chrome with a persistent profile containing saved login state, but the documentation does not prominently warn that the automation will act with the user's existing authenticated X session. In a skill that performs posting actions, this increases the risk of unintended account actions, session misuse, and broader exposure of browser state if users do not understand that a real logged-in profile is being reused.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/check-paste-permissions.ts:69

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/copy-to-clipboard.ts:59

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/paste-from-clipboard.ts:54

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/vendor/baoyu-chrome-cdp/src/index.ts:220

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/x-browser.ts:714

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/x-utils.ts:90

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/vendor/baoyu-chrome-cdp/src/index.ts:97