ClawHub
Back to skill

Security audit

Twitter Post

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Twitter/X posting tool, but it needs review because its shell-based usage can turn tweet text into command execution if handled unsafely.

Install only if you are comfortable giving this skill read/write Twitter/X API credentials. Use dry-run first, require confirmation before every post, and invoke the script with a non-shell argument API or structured stdin/JSON input rather than interpolating tweet text into an exec shell string. Keep HTTPS_PROXY unset unless you control and trust the proxy.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:42
Finding

Shell Command Injection Through User-Controlled Tweet Content

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md
All commands via `exec`. Script path: `scripts/tweet.js` (relative to this skill directory).

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
All commands via `exec`. Script path: `scripts/tweet.js` (relative to this skill directory).

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
All commands via `exec`. Script path: `scripts/tweet.js` (relative to this skill directory).

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
All commands via `exec`. Script path: `scripts/tweet.js` (relative to this skill directory).

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md
All commands via `exec`. Script path: `scripts/tweet.js` (relative to this skill directory).

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md
All commands via `exec`. Script path: `scripts/tweet.js` (relative to this skill directory).

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
* Environment variables (required):
 *   TWITTER_CONSUMER_KEY        - OAuth 1.0a Consumer Key (API Key)
 *   TWITTER_CONSUMER_SECRET     - OAuth 1.0a Consumer Secret (API Key Secret)
 *   TWITTER_ACCESS_TOKEN        - OAuth 1.0a Access Token
 *   TWITTER_ACCESS_TOKEN_SECRET - OAuth 1.0a Access Token Secret
 *
 * Optional:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
* Environment variables (required):
 *   TWITTER_CONSUMER_KEY        - OAuth 1.0a Consumer Key (API Key)
 *   TWITTER_CONSUMER_SECRET     - OAuth 1.0a Consumer Secret (API Key Secret)
 *   TWITTER_ACCESS_TOKEN        - OAuth 1.0a Access Token
 *   TWITTER_ACCESS_TOKEN_SECRET - OAuth 1.0a Access Token Secret
 *
 * Optional:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
* Environment variables (required):
 *   TWITTER_CONSUMER_KEY        - OAuth 1.0a Consumer Key (API Key)
 *   TWITTER_CONSUMER_SECRET     - OAuth 1.0a Consumer Secret (API Key Secret)
 *   TWITTER_ACCESS_TOKEN        - OAuth 1.0a Access Token
 *   TWITTER_ACCESS_TOKEN_SECRET - OAuth 1.0a Access Token Secret
 *
 * Optional:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/tweet.js (reported line 14)May include surrounding context.

js
* Environment variables (required):
 *   TWITTER_CONSUMER_KEY        - OAuth 1.0a Consumer Key (API Key)
 *   TWITTER_CONSUMER_SECRET     - OAuth 1.0a Consumer Secret (API Key Secret)
 *   TWITTER_ACCESS_TOKEN        - OAuth 1.0a Access Token
 *   TWITTER_ACCESS_TOKEN_SECRET - OAuth 1.0a Access Token Secret
 *
 * Optional:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/tweet.js (reported line 15)May include surrounding context.

js
* Environment variables (required):
 *   TWITTER_CONSUMER_KEY        - OAuth 1.0a Consumer Key (API Key)
 *   TWITTER_CONSUMER_SECRET     - OAuth 1.0a Consumer Secret (API Key Secret)
 *   TWITTER_ACCESS_TOKEN        - OAuth 1.0a Access Token
 *   TWITTER_ACCESS_TOKEN_SECRET - OAuth 1.0a Access Token Secret
 *
 * Optional:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill explicitly relies on environment variables and execution of a script, but it does not declare any tool scope such as permissions or allowed-tools. In an agent environment, that omission can let the skill run with broader-than-expected capabilities, making credential use and posting actions less transparent and harder to constrain.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This skill performs an irreversible external side effect by publishing content to the user's Twitter/X account, but the description does not clearly warn that use will post publicly. That increases the risk of users invoking it without informed consent, leading to accidental public disclosure, reputational harm, or unintended account activity.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md
5. Generate Access Token and Access Token Secret (ensure Read+Write scope)
6. If the portal only shows Read, use PIN-based OAuth flow:
   - Call `POST /oauth/request_token` with `oauth_callback=oob`
   - User opens `https://api.twitter.com/oauth/authorize?oauth_token=<token>`
   - User provides the PIN code
   - Call `POST /oauth/access_token` with the PIN as `oauth_verifier`

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This code transmits user-provided content to an external third-party service (Twitter/X) over the network, which is exactly the skill's purpose. While not inherently malicious, it is a real data-exfiltration boundary because any text passed to the script is sent off-host, and the optional proxy support can further route that traffic through another system.

Content

Scanner excerpt · scripts/tweet.js (reported line 141)May include surrounding context.

js
if (opts.replyTo) body.reply = { in_reply_to_tweet_id: opts.replyTo };
  if (opts.quoteTweetId) body.quote_tweet_id = opts.quoteTweetId;

  const r = await request('POST', 'https://api.twitter.com/2/tweets', body);
  if (r.status === 201) {
    const id = r.data.data.id;
    return {

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/tweet.js:30