T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/post-media.js:23- Finding
Unrestricted Local File Selection for Remote Media Upload
- Content
View full analysis
- Remediation
View remediation
Security audit
X Expert
Security checks for vulnerabilities and agentic risk
Overview
This skill is a real X/Twitter publishing helper, but it can directly post, upload media, and delete tweets using live account credentials without code-enforced confirmation.
Install only if you are comfortable giving the skill live X account credentials. Use least-privilege X tokens, test with a non-production account first, review every final post/media path manually, and avoid invoking delete-tweet.js or direct publishing unless you intentionally want immediate irreversible account changes.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/post-tweet.js:27- Finding
Publishing and Deletion Operations Execute Without Enforced User Confirmation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (45)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill advertises an assistant-style workflow but appears to include direct posting capability with no explicit declared permissions. In a skill that uses X API credentials, undeclared write actions are dangerous because they can publish content on behalf of the user without sufficiently transparent authorization boundaries.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill advertises an assistant-style workflow but appears to include direct posting capability with no explicit declared permissions. In a skill that uses X API credentials, undeclared write actions are dangerous because they can publish content on behalf of the user without sufficiently transparent authorization boundaries.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill advertises an assistant-style workflow but appears to include direct posting capability with no explicit declared permissions. In a skill that uses X API credentials, undeclared write actions are dangerous because they can publish content on behalf of the user without sufficiently transparent authorization boundaries.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The skill advertises an assistant-style workflow but appears to include direct posting capability with no explicit declared permissions. In a skill that uses X API credentials, undeclared write actions are dangerous because they can publish content on behalf of the user without sufficiently transparent authorization boundaries.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill advertises an assistant-style workflow but appears to include direct posting capability with no explicit declared permissions. In a skill that uses X API credentials, undeclared write actions are dangerous because they can publish content on behalf of the user without sufficiently transparent authorization boundaries.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The skill advertises an assistant-style workflow but appears to include direct posting capability with no explicit declared permissions. In a skill that uses X API credentials, undeclared write actions are dangerous because they can publish content on behalf of the user without sufficiently transparent authorization boundaries.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `collect-info.js` | 使用 Exa/MiniMax/Brave Search 收集信息 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `generate-tweet.js` | 根据主题和风格生成推文内容 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `post-tweet.js` | 发布单条推文 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `post-thread.js` | 发布推文串 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `post-media.js` | 发布带媒体的推文 |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## 故障排除 - 如果收到 401 错误，检查 Access Token 是否有效 - 如果收到 403 错误，检查 App 权限 - 如果图片生成失败，检查 API 配置
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The README instructs users to execute
npx clawhub@latest install x-expert, which pulls and runs the latest package version at install time rather than a pinned, reviewed release. This creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious update is published, users may execute attacker-controlled code during installation.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README advertises a
delete-tweet.jsscript even though the described skill scope is a create/plan/publish assistant. This scope expansion introduces a destructive capability that users may not expect, increasing the risk of accidental or hidden content deletion if the skill or surrounding agent invokes undocumented actions.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README lists tweet deletion as a supported script without any warning that it is a destructive operation. In a conversational publishing skill, omission of a prominent warning and confirmation expectations makes accidental or socially engineered deletion more plausible, especially if users assume all listed actions are routine and safe.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is explicitly designed to publish, schedule, and delete tweets using real X credentials, but the README does not warn users that these actions affect live accounts and may be public, automated, or difficult to fully undo. In this context, lack of an operational safety warning increases the chance of accidental posting, reputational damage, unintended deletions, or misuse of privileged social-media access.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The README instructs users to run
npx clawhub@latest install x-expert, which fetches and executes the latest CLI code without pinning a specific trusted version. If the upstream package is compromised or a breaking/malicious release is published, users could execute attacker-controlled code during installation.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill declares access to environment variables and relies on outbound network activity, but it does not declare an explicit tool scope such as permissions or allowed-tools. That makes the skill's effective authority opaque to users and reviewers, increasing the chance of unintended credential use or external data transmission.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest description forces a specific language/locale for the skill experience by presenting the core description entirely in Chinese. The file does not indicate that users can choose another language or that the Chinese-only behavior is limited to a justified region-specific use case.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The prescribed user prompts throughout the workflow are all fixed in Chinese, which creates a language policy issue when no alternative language path or opt-in is provided. Because these are the required interaction strings, the skill effectively enforces one locale for all users.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documentation says publishing should default to user confirmation, but it also offers a 'direct publish' review mode. For a skill with posting authority to a social-media account, this weakens a key safety barrier and can lead to accidental or unauthorized publication.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file presents its purpose and CLI usage entirely in Chinese, including the expected query example, which implies a language-specific interaction model. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified; neither is present here.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
js throw new Error('EXA_API_KEY not set'); } const response = await fetch('https://api.exa.ai/search', { method: 'POST', headers: { 'Content-Type': 'application/json',
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
js throw new Error('EXA_API_KEY not set'); } const response = await fetch('https://api.exa.ai/search', { method: 'POST', headers: { 'Content-Type': 'application/json',
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
js throw new Error('MINIMAX_API_KEY not set'); } const response = await fetch('https://api.minimax.chat/v1/web_search', { method: 'POST', headers: { 'Content-Type': 'application/json',
Static analysis
Detected: suspicious.env_credential_access
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/collect-info.js:13
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/generate-image.js:37