Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
X Analytics CLI
v1.0.0X (Twitter) analytics and data retrieval via x-analytics-cli. Use when the user wants to search tweets, count tweet volumes, look up user profiles, get tweet...
⭐ 0· 13·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md clearly documents a CLI wrapper that needs x-analytics-cli and four OAuth 1.0a credentials (X_API_KEY, X_API_SECRET, X_ACCESS_TOKEN, X_ACCESS_TOKEN_SECRET). The registry metadata, however, lists no required binaries, no required env vars, and no primary credential. That is an incoherence: a CLI integration should declare the CLI binary and the credential requirements in metadata.
Instruction Scope
The runtime instructions tell the agent to run local commands (x-analytics-cli), possibly install the npm package globally (npm install -g x-analytics-cli), and resolve credentials via env vars or a local file (~/.config/x-analytics-cli/credentials.json). Those are reasonable for the described purpose, but they require reading local credentials and executing local tooling — and the skill metadata did not surface those requirements. The instructions do not direct data to unexpected external endpoints beyond the expected X API calls via the CLI.
Install Mechanism
There is no install spec in the registry entry (instruction-only skill). SKILL.md suggests installing via `npm install -g x-analytics-cli`, which is a public-registry install pattern but not vetted by the metadata. Because the package source/homepage is missing, recommending a global npm install without provenance increases risk.
Credentials
The skill legitimately needs four OAuth credentials to call the X API, which is proportionate to the described functionality — but the registry metadata declares no required env vars or primary credential. The discrepancy means the skill could read sensitive local credentials (env or file) without that being apparent from metadata.
Persistence & Privilege
The skill is not marked always:true and does not request persistent system-wide privileges. It is user-invocable only and does not claim to modify other skills or system configuration.
What to consider before installing
This skill appears to be a wrapper for an external CLI and requires four X (Twitter) OAuth credentials, but the registry metadata doesn't declare those requirements and the package has no source/homepage listed. Before installing or using it: 1) Verify the npm package name and its author/website (don't run `npm install -g` for an untrusted package). 2) Prefer using minimal-scope credentials or a read-only token and avoid placing tokens in shared home config if possible. 3) If you must use it, inspect the CLI package source code (or use a vetted client) to confirm it only performs the documented read-only X API calls. 4) Treat the metadata mismatch as a red flag — ask the publisher for source/homepage and an explanation for why required binaries/env vars weren't declared.Like a lobster shell, security has layers — review code before you run it.
latestvk972aysrvq1x1826dk9th9tbss84en3f
License
MIT-0
Free to use, modify, and redistribute. No attribution required.