ClawHub
Back to skill

Security audit

Bird.Backup

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real X/Twitter CLI wrapper, but it asks users to trust an unpinned external program with live account cookies and browser profile access.

Review before installing. Use only if you trust the publisher and the exact external bird package being installed, avoid putting live cookies directly in commands or project config, prefer a dedicated browser profile for X/Twitter, and assume the tool can read private account data and perform account actions such as posting or following.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:16
Finding

Unpinned Third-Party CLI Is Downloaded and Executed with Access to Authentication Cookies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5 and 16-22
Vulnerability Type: Unpinned third-party dependency and immediate remote package execution
Risk Level: High

Relevant code snippet:

yaml
metadata: {"clawdbot":{"emoji":"🐦","requires":{"bins":["bird"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/bird","bins":["bird"],"label":"Install bird (brew)","os":["darwin"]},{"id":"npm","kind":"node","package":"@steipete/bird","bins":["bird"],"label":"Install bird (npm)"}]}}
bash
# npm/pnpm/bun
npm install -g @steipete/bird

# Homebrew (macOS, prebuilt binary)
brew install steipete/tap/bird

# One-shot (no install)
bunx @steipete/bird whoami

Technical Analysis

The Skill delegates its entire implementation to the external @steipete/bird package or the steipete/tap/bird Homebrew formula. None of the documented installation commands pins a package version, source revision, or cryptographic integrity digest.

In particular, bunx @steipete/bird whoami can download and immediately execute the package version resolved at invocation time. Consequently, the effective executable may change after this Skill has been reviewed. The reviewed project contains only SKILL.md, so the external executable's handling of browser cookies, account data, and network destinations cannot be verified from the project itself.

This is especially sensitive because the CLI is subsequently authorized to extract browser cookies or receive X/Twitter authentication cookies directly. Although network communication and authenticated account access are necessary for the declared X/Twitter client functionality, allowing an unpinned and externally mutable executable to receive those privileges exceeds what can be safely validated from the Skill package.

No evidence in SKILL.md proves that the current upstream package is malicious or sends credentials to an unrelated destination. The vulner ...[truncated 1900 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the npm package and Homebrew artifact to a specifically reviewed version rather than resolving the latest available release.
  2. Verify downloaded artifacts using a cryptographic integrity hash or signed, reproducible release mechanism.
  3. Avoid recommending one-shot remote execution through bunx for a tool that will receive authentication cookies.
  4. Publish the expected upstream repository and commit corresponding to the approved release so its behavior can be independently audited.
  5. Prefer an installation workflow that downloads, verifies, and then executes the artifact as separate steps.
  6. Disable package installation lifecycle scripts where feasible and document whether the package uses them.
  7. Run the CLI with least privilege, restricting it to a dedicated browser profile containing only the required X/Twitter session.
  8. Constrain outbound network access to the X/Twitter endpoints required for operation where the execution environment supports network policy enforcement.
  9. Document a dependency review and update process so new versions are audited before the pinned release is changed.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:151
Finding

Authentication Cookies May Be Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29 and 151-152
Vulnerability Type: Sensitive credential exposure through process arguments and command history
Risk Level: Medium

Relevant code snippet:

text
Use `--auth-token` / `--ct0` to pass cookies directly, or `--cookie-source` for browser cookies.
bash
--auth-token <token>       # Set auth_token cookie
--ct0 <token>              # Set ct0 cookie

Technical Analysis

The Skill explicitly supports passing the X/Twitter auth_token and ct0 cookie values as command-line arguments. Secrets supplied this way may be exposed through:

  • Shell history files.
  • Process listings and process inspection interfaces.
  • Agent execution traces or orchestration logs.
  • Terminal session recordings.
  • Monitoring, debugging, crash-reporting, or telemetry systems that record command arguments.
  • Copy-and-paste history or support transcripts.

The auth_token is a reusable session credential, while ct0 participates in authenticated request and CSRF handling. Disclosure can therefore enable unauthorized use of the user's existing X/Twitter session. Passing these values in process arguments is not necessary when safer secret-input channels such as protected standard input, an operating-system credential store, or a restricted-permission secret file are available.

The documentation does not contain hardcoded credentials, and it does not itself transmit a token to an unrelated service. The issue is that the recommended interface can cause users or Agents to disclose credentials to local and operational logging surfaces before the CLI sends them to the intended service.

Attack Path

  1. A user or Agent invokes bird with a literal value supplied to --auth-token or --ct0.
  2. The full command is stored in shell history, captured in an Agent/tool log, or temporarily exposed through operating-system process inspection. ...[truncated 1079 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace command-line secret arguments with a protected standard-input or file-descriptor interface.
  2. Integrate with the operating system's credential store or keychain for persistent authentication material.
  3. If a secret file is supported, require restrictive filesystem permissions and reject files readable by other users.
  4. Clearly warn users not to place literal token values in shell commands, scripts, chat prompts, or Agent-visible command logs.
  5. Ensure the CLI and surrounding Agent framework redact --auth-token, --ct0, cookie headers, and equivalent values from diagnostics and telemetry.
  6. Avoid environment variables as the primary remediation where the platform exposes process environments to other users or diagnostic systems.
  7. Prefer a dedicated, minimally privileged browser profile when cookie extraction is used, and request explicit user approval before accessing its cookie database.
  8. Provide documented token revocation and session-rotation steps for suspected exposure.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

er cookies (repeatable) --chrome-profile # Chrome profile name --chrome-profile-dir # Chrome/Chromium profile dir or cookie DB path --firefox-profile # Firefox profile --timeout # Request timeout --cookie-timeout # Cookie extraction timeout

text

## Config File

`~/.config/bird/config.json5` (global) or `./.birdrc.json5` (project):

```json5
{
  cookieSource: ["chrome"],
  chromeProfileDir: "/path/to/Arc/Profile",
  timeoutMs: 20000,
  quoteDepth: 1
}

Environment variables: BIRD_TIMEOUT_MS, BIRD_COOKIE_TIMEOUT_MS, BIRD_QUOTE_DEPTH

Troubleshooting

Query IDs stale (404 errors)

bash
bird query-ids --fresh

Cookie extraction fails

  • Check browser is logged into X
  • Try different --cookie-source
  • For Arc/Brave: use --chrome-profile-dir

TL;DR: Read/search/engage with CLI. Post carefully or use browser. 🐦

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly instructs users to supply live X/Twitter session cookies via command-line flags or extract them from browser profiles, but it does not include a clear warning about the sensitivity of those credentials. Session cookies can grant full account access and may be exposed through shell history, process listings, logs, or unsafe project config files, making account takeover possible if mishandled.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.