Security audit

X Timeline Digest

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed X/Twitter timeline digest tool with some privacy and prompt-safety hygiene issues, but no evidence of deception, exfiltration, destructive behavior, or hidden authority.

Before installing, be comfortable with the skill reading your authenticated X/Twitter For You and Following timelines via bird and storing tweet IDs locally for deduplication. Treat generated tweet content as untrusted when sending it to an LLM, and avoid using the output for automatic posting or actions without review. The publisher should remove bundled sample digest files and clarify that Chinese summarization is an optional downstream LLM step unless implemented in the script.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: PROMPT.md:52
Finding: Untrusted Timeline Content Is Passed to an LLM Without Prompt-Injection Defenses
Content: View full analysis
{ return `${i+1}. ${t.author}: ${t.text.replace(/\n/g, ' ')} (${t.url})`; }).join('\n\n'); const response = { window: { start: state.lastRunAt, end: now.toISOString(), intervalHours: CONFIG.intervalHours }, counts, digestText: `Found ${finalItems.length} top tweets.\n\n${digestText}`, items: finalItems }; ``` ### Technical Analysis Tweet text is externally controlled content retrieved from X. The implementation copies `t.text` into both `digestText` and `items` without establishing a trusted-data boundary. The documented workflow then substitutes the complete JSON object dir ...[truncated 2268 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: latest_digest.json:1
Finding: Generated Personalized Timeline Data Is Bundled in the Skill Package
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Line L21 states that the entire output must be in Simplified Chinese, which is a natural-language locale constraint. Because the file does not provide user opt-in, alternatives, or justification for a region-specific requirement, this violates the language/locale policy criterion.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill reads authenticated X/Twitter timelines via an already logged-in bird session and persists processing state, but the documentation does not prominently warn users that personal account data and behavioral content will be accessed and processed. In agent ecosystems, missing privacy disclosure can lead to users enabling the skill without informed consent, increasing the chance of unintended collection, retention, or forwarding of sensitive timeline data upstream.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The overview says the skill itself will 'Generate a Chinese digest' and 'Output a structured payload', implying digest generation is part of the code's behavior. However, the usage section later states users must separately read PROMPT.md and send the prompt plus JSON to an LLM, which contradicts the claim that the script itself generates the digest.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file states 'Generate a Chinese digest' and later specifies 'Language: Simplified Chinese' as part of the processing pipeline. This is a natural-language locale policy issue because the skill forces a specific language output without offering the user an explicit language or locale choice.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The pipeline presents Chinese digest generation as step 6 of the skill's processing flow, suggesting it is part of the skill's actual runtime behavior. Yet the same file describes LLM use as an external follow-up step performed by the operator, so the documentation conflicts about whether digest generation is inside or outside the skill.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The output example includes 'digestText' with Chinese summary content, which implies the script returns completed digest text. This conflicts with the usage section's statement that users must manually send the generated JSON to an LLM using PROMPT.md to obtain the 'Smart Brief'.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The manifest describes a timeline-digest builder that outputs payloads for upstream delivery, which suggests transient processing of fetched timeline data. The code additionally creates a state directory under ~/.openclaw and reads/writes persistent history and last-run metadata, introducing durable local storage behavior not reflected in the description.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The comments explicitly state that the spec says to generate a Chinese digest, then note the script will only provide a basic concatenation. The actual output uses English text like "Found N top tweets" and raw tweet listings, which directly conflicts with the stated documented intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The digestText field presents content in Chinese, Japanese, and English in a single output, but the file provides no indication that the user opted into multilingual output or that locale selection is supported. This can conflict with organizational language/locale policies that require respecting user language preferences.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The comment states the spec requires the script to "Generate a Chinese digest," which imposes a specific language choice. There is no indication in this file that the user can choose the digest language or opt into Chinese output, which conflicts with the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: This plain-text digest includes substantial Chinese-language entries alongside English content, but provides no indication that the user opted into a Chinese or multilingual output. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.install_untrusted_source

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: digest.js:77

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: latest_digest.json:14