X Growth Automation

ReviewAudited by ClawScan on May 1, 2026.

Overview

This skill coherently scaffolds an X/Twitter automation project and defaults to dry-run, but users should notice the public-posting and credential implications before enabling live mode.

Install only if you want an agent to scaffold a social-posting automation project. Keep it in dry-run first, use a fresh target folder, store X/Bird credentials outside chat in a local secret store or .env file, and enable live publishing only after reviewing cadence, monthly caps, reply/CTA policy, and logging.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

If live mode is enabled, mistakes or unwanted drafts could be posted publicly from the user's account.

Why it was flagged

The skill can configure automation that posts publicly through the user's X account. The same instructions disclose safety controls, so this is purpose-aligned but important for users to notice.

Skill content

Treat X API as **write/publish layer**. ... Keep publish disabled by default unless the user explicitly asks for live publishing.

Recommendation

Start in dry-run, review generated drafts and schedules, set conservative daily/monthly caps, and enable live publishing only after explicit approval.

Medium

#ASI03: Identity and Privilege Abuse

What this means

Anyone who obtains these credentials could potentially access or post through the connected X account, depending on token scope.

Why it was flagged

The scaffold prepares placeholders for X API credentials and session-style tokens. These are expected for X/Bird automation, but they are high-value account credentials.

Skill content

X_API_KEY=
X_API_SECRET=
X_ACCESS_TOKEN=
X_ACCESS_TOKEN_SECRET=
AUTH_TOKEN=
CT0=

Recommendation

Use least-privilege X API credentials, avoid pasting secrets into chat, store them only in a local .env or secret manager, and rotate them if exposed.

Low

#ASI05: Unexpected Code Execution

What this means

If pointed at an existing project, the script can overwrite scaffolded files such as README.md and config files.

Why it was flagged

The scaffold script writes files into the user-supplied target path. This is central to the skill's purpose and is disclosed, but the target directory should be chosen carefully.

Skill content

root = Path(args.path)
    root.mkdir(parents=True, exist_ok=True)

    write(root / "README.md", README)

Recommendation

Use a new empty folder unless intentionally adapting an existing repository, and review changes before committing or running any generated automation.