ClawHub
Back to skill

Security audit

X CDP Automation

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated X automation purpose, but it should be reviewed because setup can automatically install and prioritize unpinned code from /tmp, and account checks can fail open before public posting.

Install only if you are comfortable giving the skill control of a logged-in X browser profile. Use a dedicated Chromium profile and account, keep the CDP port local, prefer dry-run first, and require explicit confirmation before posting. Avoid the default /tmp dependency flow; install pinned dependencies in a project-controlled directory before use, and treat the --account check as unreliable for article publishing until it fails closed when the account cannot be detected.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/setup.js:120
Finding

Unpinned dependency installation and module loading from shared temporary storage

Content
View full analysis
/dev/null; npm install puppeteer-core 2>&1', { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'], }); ok('puppeteer-core installed to /tmp/node_modules'); return '/tmp/node_modules'; } catch (e) { fail(`Auto-install failed: ${e.message}`); log('Please install manually and re-run setup.'); return null; } ``` ```js // scripts/lib/cdp-utils.js:6-7 module.paths.unshift('/tmp/node_modules'); const puppeteer = require('puppeteer-core'); ``` ### Technical Analysis The setup process installs the latest available `puppeteer-core` package without a pinned version or lockfile. It places the package under the globally shared `/tmp` hierarchy and subsequently gives `/tmp/node_modules` priority in Node.js module resolution. The implementation only verifies that a path named `puppeteer-core` exists. It does not verify package ownership, directory permissions, package version, integrity hashes, provenance, or whether the discovered module was installed by this project. ...[truncated 1889 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/lib/cdp-utils.js:140
Finding

Expected X account verification fails open when account detection is unavailable

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This code chunk does not implement the declared X/Twitter automation behavior. Instead, it is a generic utility for parsing CLI arguments and validating some inputs. While such a parser could be a supporting helper within a larger X automation project, the supplied chunk itself has a materially different direct purpose and shows none of the claimed browser automation, X interactions, or article publishing capabilities. Therefore, the description does not accurately represent what this specific code chunk actually does.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md
node scripts/setup.js [--port 18802] [--profile ~/chromium-profiles/x-cdp]

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md
node scripts/setup.js [--port 18802] [--profile ~/chromium-profiles/x-cdp]

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md
NODE_PATH=/tmp/node_modules node scripts/post-article.js --title "Title" --body "Body text" [--body-file /path/to/content.md] [--cover /path/to/cover.jpg] [--po

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md
- `scripts/lib/cdp-utils.js` SELECTORS object

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding

The skill directs the agent to inspect the local environment and run shell commands, but it declares no tool scope or permissions boundaries. That creates an authorization gap where a skill that appears content-focused can still induce local system interaction, increasing the chance of unintended command execution or data exposure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Auto-installing puppeteer-core into /tmp/node_modules introduces package-management behavior that is more powerful than the stated task of interacting with X. This can modify the host environment and pull executable code from the package ecosystem, creating supply-chain and unexpected-execution risk if performed automatically by an agent.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

brew install --cask chromium

Linux

sudo apt install chromium-browser

text

**Install puppeteer-core**:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The agent integration section instructs the agent to run local setup, curl localhost, and execute posting scripts, expanding from social-media assistance into system administration and command execution. In an agent setting, this is dangerous because a user request to post content could trigger package installation, browser launching, and local process interaction without a separately scoped approval boundary.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.js (reported line 98)May include surrounding context.

js
log('  brew install --cask chromium');
    log('  # or download from https://www.chromium.org/getting-involved/download-chromium/');
  } else if (platform === 'linux') {
    log('  sudo apt install chromium-browser   # Debian/Ubuntu');
    log('  sudo dnf install chromium           # Fedora');
    log('  # or download from https://www.chromium.org/getting-involved/download-chromium/');
  } else {

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.js (reported line 99)May include surrounding context.

js
log('  brew install --cask chromium');
    log('  # or download from https://www.chromium.org/getting-involved/download-chromium/');
  } else if (platform === 'linux') {
    log('  sudo apt install chromium-browser   # Debian/Ubuntu');
    log('  sudo dnf install chromium           # Fedora');
    log('  # or download from https://www.chromium.org/getting-involved/download-chromium/');
  } else {

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The setup script automatically runs npm commands and writes into /tmp without obtaining explicit user consent. In a security-sensitive automation skill, implicit package installation expands the trust boundary to the npm ecosystem and can expose users to supply-chain compromise, unexpected code execution during install scripts, or module hijacking from a world-writable location.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This reference specifies locale-specific selectors and labels for zh-CN and English UI text, but does not state that locale handling is optional or user-selected. Under the policy rule, forcing or assuming a specific language/locale without opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/setup.js:78