Grok Twitter Search

• Outcome: Review
• Latest audit: May 29, 2026 · 9:22 PM UTC
• Version: 1.0.2

Overview

The advertised Twitter search skill bundles unrelated memory, automation, MCP, and blockchain-trading files that materially exceed what a user would expect from a Grok Twitter search install.

Review this package carefully before installing. The Grok search script itself looks like a normal API client, but the distributed artifact is not limited to that skill. Install only the grok-twitter-search subdirectory if possible, avoid enabling the bundled memory/heartbeat/blockchain tools unless you explicitly want them, and do not provide wallet private keys or long-lived API tokens to this package without isolating and auditing the exact files you will run.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (34)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

del env["SOCKS5_PROXY"]
    
    try:
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

• Confidence: 80% confidence
• Finding: result = subprocess.run( cmd, capture_output=True, text=True, timeout=30, env=env )

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The privacy boundary says 'Private things stay private,' but the skill also instructs the agent to read and update memory files each session without clearly limiting scope, consent, or data classes. That creates a real risk of unnecessary collection and persistence of sensitive user data, especially because these files are framed as the agent's ongoing memory and could encourage broad retention beyond the immediate task.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The function is presented as offering configuration suggestions, but it can also modify `~/.openclaw/openclaw.json` on disk. That mismatch reduces informed consent and can cause users or downstream tooling to underestimate that the script persists secrets and changes application behavior.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The heartbeat behavior is driven by a configurable prompt and broad polling guidance, which can cause the agent to perform recurring checks and actions with weakly bounded triggers. In an adversarial or misconfigured workspace, this increases the chance of unintended autonomous behavior, privacy-invasive monitoring, or prompt-driven task execution outside clear user intent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The instruction to delete BOOTSTRAP.md on first run encourages destructive file modification without a user-facing confirmation step. Because all skill content must be treated as potentially adversarial, this creates a dangerous pattern where initialization instructions can erase evidence, provenance, or recovery data before the user reviews them.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation instructs users to run a command that writes a new memory entry and rebuilds the index, but it does not clearly warn that this operation modifies persistent local data. In a skill/setup context, users may treat commands as safe to copy-paste, so the omission increases the risk of unintended data changes and accidental storage of sensitive information.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The document provides a destructive find command that permanently deletes memory files older than 30 days without any warning, confirmation step, or backup guidance. In an agent skill/setup document, this is especially risky because users may execute maintenance commands verbatim, leading to irreversible data loss of potentially valuable or sensitive records.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README explicitly instructs users to place a bearer token in environment variables and a plaintext config.json file, but provides no warning about credential sensitivity, file permissions, shell history exposure, or avoiding committing config files to source control. While this is common operational guidance, it still increases the chance of accidental token disclosure through dotfiles, screenshots, process listings, backups, or repository commits.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly instructs users to place the API token in a local config.json file in plaintext, without any warning about credential exposure risk. Plaintext secrets in project directories are commonly leaked via source control, backups, shared folders, or local compromise, making unauthorized API access more likely.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly recommends placing the API token in a project-local config.json in plaintext, but does not warn about accidental exposure through source control, backups, shared workspaces, or local file disclosure. Because this is installation guidance for a developer tool, users may copy this pattern directly and unintentionally persist long-lived credentials in an unsafe location.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly instructs users to place the API token in plaintext environment-like config files and client settings, including a project-root config.json. This is risky because such files are commonly copied, backed up, screen-shared, or accidentally committed to source control, leading to credential disclosure and unauthorized API use.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The skill requires sending a bearer token and user queries to a third-party API but does not warn users that credentials and search terms are transmitted off-platform. This is a genuine transparency and privacy/security issue because users may unknowingly expose sensitive tokens or query content to an external service.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The WebSocket client embeds the API token directly in the connection URL via a query parameter. Tokens in URLs are commonly exposed through logs, reverse proxies, browser/history tooling, monitoring systems, and exception messages, so credential leakage is more likely than when tokens are sent in headers or a dedicated authentication message. In this skill context, the code is an API client handling authentication for a news platform, so the issue is real and not justified by the domain.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The README instructs users to obtain and supply a bearer token and run a service that sends queries to a third-party API, but it does not clearly warn that prompts, usernames, search terms, and related query data will be transmitted off-host to ai.6551.io or another configured endpoint. In an agent/MCP context, that omission can mislead users into exposing sensitive investigative queries or credentials without informed consent, especially because the README actively encourages automated review-and-install flows.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README explicitly recommends storing the API token in a local config.json file and shows the secret inline, but it does not warn users about file permission risks, accidental commits, shell history leakage, or shared-workstation exposure. While documentation alone is not executable code, normalizing plaintext secret storage increases the chance of credential compromise and unauthorized API use.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The README provides many client configuration examples that embed TWITTER_TOKEN directly into persistent JSON/YAML config files without any cautionary guidance. This encourages users to place long-lived credentials into files that may be backed up, synced, committed, or exposed to other local users and tools, broadening the attack surface for secret theft.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README explicitly recommends storing the API token in a local config.json file and even shows the token field in plaintext, but it does not warn about secrets handling, file permissions, or the risk of accidentally committing the file to version control. This can lead to credential exposure through source control, backups, screenshots, or shared project directories, especially because this is installation documentation users are likely to follow verbatim.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation instructs users to place a bearer token in environment variables and a local config.json file, including an example with the token stored in plaintext, but does not warn that the token is a sensitive secret that must not be committed, logged, shared, or embedded in project files. In a repo/install-guide context this meaningfully increases the risk of credential leakage through shell history, screenshots, copied configs, or accidental version control commits.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs users to send authenticated requests with a bearer token to an external API but does not clearly disclose the privacy and trust implications of transmitting account-linked query data to a third-party service. In this context, the risk is not direct code execution, but undisclosed external data transmission and credential use can mislead users about where their requests and metadata are going.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: User-controlled task content is interpolated directly into a shell command passed to execSync, creating a command injection risk. If an attacker can influence the task string or message content, they may break out of the quoted argument and execute arbitrary shell commands on the host.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document provides step-by-step instructions for wallet-based authentication, token image upload, and irreversible on-chain token creation, but it does not warn users that signing a login message exposes wallet-linked identity data, that uploaded content is sent to a third party, or that blockchain transactions are irreversible and may incur financial loss. In the context of an agent skill, this omission is risky because an automated agent could guide or nudge a user through sensitive actions without clear consent and safety checkpoints.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation instructs users to export a raw PRIVATE_KEY and perform blockchain token creation, but it does not prominently warn that private keys are highly sensitive credentials and that on-chain transactions are irreversible and may incur real financial loss. In a token-creation context, this omission increases the chance of unsafe key handling, accidental mainnet usage, and unintended asset expenditure.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script directly consumes a raw PRIVATE_KEY from the environment and immediately uses it to sign a login challenge, with only a minimal 'Set PRIVATE_KEY' prompt and no meaningful warning about the risks of exposing or mishandling wallet credentials. In the context of a token-creation skill that interacts with third-party infrastructure, this is dangerous because users may paste production wallet keys into an automation flow without clear consent boundaries, increasing the chance of key theft via logs, shell history, CI environments, or misuse of the script.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script immediately performs two state-changing on-chain actions—ERC-20 approval and token sale—based solely on command-line arguments and an environment-provided private key, with no interactive confirmation, dry-run preview, or safety checks on the resolved tokenManager address. Because blockchain transactions are irreversible, a mistaken token address, amount, RPC response, or automation trigger can permanently authorize spending and sell assets before the operator has a chance to catch the error.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The README instructs users to search Twitter/X content through xAI Grok and discusses proxy routing, but it does not clearly disclose that user prompts and search terms are sent to third-party services and may also transit through a configured proxy. This creates a real privacy and data-handling risk because users may submit sensitive queries without understanding that the data leaves the local environment.

VirusTotal

45/45 vendors flagged this skill as clean.