Security audit
Security checks for vulnerabilities and agentic risk
This skill is coherent for managing a ClawOS X account, but it enables public posting and engagement without an explicit user confirmation step.
Install only if you intend the agent to act on an authenticated @ClawOS X account. Before use, add or enforce a workflow that previews every post, reply, like, retweet, and quote tweet and requires explicit user approval before publishing.
The skill description is broadly phrased around operating an automated X account for posting, replying, engaging, and managing brand presence. That broad activation scope can cause the skill to trigger on ordinary social-media requests without sufficient confirmation, increasing the chance of unintended use of high-impact account actions.
The skill explicitly instructs the agent to post, reply, like, retweet, and quote-tweet from a public brand account, but it does not require any user warning, confirmation, or approval gate before performing those irreversible public actions. In a social-media account-management context, this increases the risk of accidental brand damage, unauthorized communications, and abuse through prompt-triggered actions.
The phrase "Ask me anything" is extremely broad and not domain-specific, so it can collide with ordinary user requests unrelated to operating the X account. In a skill context, this can contribute to unintended invocation or overly broad expectations about what the skill should handle.
