Openclaw Twitter Monitor

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:26 AM UTC
• Version: 3.3.18

Overview

This is a disclosed crypto-monitoring skill, but users should be careful because it makes authenticated paid API calls and can set up recurring reports.

Install only if you trust CT Monitor with your API key and billing account. Use explicit CT Monitor prompts, review any cron job before enabling it, and treat market reports, links, and investment suggestions as untrusted external data that may be wrong or manipulated.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:107

Finding

Untrusted Remote Content Is Incorporated Verbatim into Agent Output

Content

View full analysis

- Source A: `.report` — AI-generated briefing (Markdown string) with sections: Market Overview (prices), Key News, Sector Highlights, Notable Alpha. **If you received the full JSON object `{"report": "...", ...}` instead of a string, extract `.report` before proceeding. Never treat an empty `.report` as a reason to fabricate — if the field is genuinely empty, skip that section and note "briefing unavailable".** > - Source B: trending token list — each item: `symbol`, `cg_rank` (CoinGecko trending rank, 1=hottest), `mention_count` (distinct KOLs mentioning it), `price_change` (24h % from CoinGecko, accurate per-token), `top_kols`, `sample_tweets` > - Source C: alpha signals — each item: `keyword` (token), `kol_count`, `kols`, `sample_tweets` > - Source D: market summary — `global` (BTC dominance, total market cap, 24h change) + `prices` object with keys `bitcoin`/`ethereum`/`solana`/`binancecoin`/`ripple`, each containing `price_usd`, `change_24h`, `source` > - Source E: news feed — each item: `title`, `source` (media name, e.g. "CNN", "Reuters", "PRNewswire", "Twitter"), `score` (AI quality score 0-100), `summary` (AI-generated Chinese summary), `url` (may be null for 6551 news) > - Source F: smart money signals — latest buy/sell signals, each item: `ticker`, `direction` (buy/sell), `smartMoneyCount`, `triggerPrice`, `currentPrice`, `maxGain`, `chainId` > > Generate a **Markdown-formatted** morning intelligence report with this exact structure: > > **Header**: Use the exact date/time from `.report` (e.g. "October 26, 2024 20:30 PST") > > **📊 Market Overview**: Copy the Mark ...[truncated 3939 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (59)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The skill documents a destructive endpoint for removing subscriptions and elsewhere encourages the agent to decide actions from user intent. In a skill with broad triggers and automation patterns, exposing state-changing endpoints without an explicit confirmation and strict parameter validation raises the risk of unintended watchlist modification or deletion.

Content

Scanner excerpt · SKILL.md (reported line 978)May include surrounding context.

md

| AI briefing | `GET /brief/generate?hours=24` — returns `{"report": "...", "hours": N, ...}`; use `.report` field |
| KOL ranking | `GET /users/top?limit=10` |
| Add to watchlist | `POST /subscriptions/?username=pump_fun` |
| Remove from watchlist | `DELETE /subscriptions/pump_fun` |
| System status | `GET /price/summary` |
| **Binance Smart Money Inflow** | `POST https://web3.binance.com/bapi/defi/v1/public/wallet-direct/buw/wallet/token/inflow/rank/query` — smart money net inflow ranking (no auth) |
| **Binance Trading Signal** | `POST https://web3.binance.com/bapi/defi/v1/public/wallet-direct/buw/wallet/web/signal/smart-money` — on-chain buy/sell signals (no auth) |

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The statement that users can ask in natural language and the system will 'automatically call the right APIs' encourages broad, implicit tool activation without tight trigger boundaries. In an agent environment, this can cause the skill to be invoked from generic discussion or indirectly quoted text, leading to unintended external requests and possible spend or data disclosure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The example prompts are broad research-style requests such as market briefings, due diligence, and security alerts, with no explicit requirement that the user consent to external API use or paid actions. In agent systems, such generic phrasing increases the chance of accidental invocation and chaining into multiple paid or stateful API calls from ordinary conversation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 42)May include surrounding context.

md

### Step 1: Get an API Key

Visit [api.ctmon.xyz/docs](https://api.ctmon.xyz/api/docs) to register and get your API Key.

### Step 2: Install the Skill in OpenClaw

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 340)May include surrounding context.

md

### Step 1: Get an API Key

Visit [api.ctmon.xyz/docs](https://api.ctmon.xyz/api/docs) to register and get your API Key.

### Step 2: Install the Skill in OpenClaw

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 354)May include surrounding context.

md

### Step 1: Get an API Key

Visit [api.ctmon.xyz/docs](https://api.ctmon.xyz/api/docs) to register and get your API Key.

### Step 2: Install the Skill in OpenClaw

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README presents CT Monitor primarily as a read/analysis skill, but it also documents a state-changing endpoint to add custom monitoring targets via POST /subscriptions/?username=XXX. That mismatch is security-relevant because an agent or user may assume the skill is non-mutating and permit it in contexts where write actions should be disallowed, enabling unintended persistent changes to backend monitoring configuration.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The skill is built around sending an Authorization bearer token from the environment to an external domain for nearly all workflows. This is sensitive because accidental invocation or misuse causes authenticated requests to leave the local environment, and the token grants billable or privileged access to a remote service.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

## Configuration

**Base URL**: `https://api.ctmon.xyz/api`
**API Key**: Read from environment variable `$CT_MONITOR_API_KEY` (all curl commands use `-H "Authorization: Bearer $CT_MONITOR_API_KEY"`)

## Core Directives

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to proactively present a menu when users say broad phrases like 'what can you do?' or 'how do I use this?', which can overlap with normal conversation and trigger the skill without clear user intent to use this specific integration. This increases the chance of unintended invocation and downstream external API access, especially because the skill is designed to orchestrate many network calls automatically.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The listed trigger phrases include vague everyday language like 'trending', 'narrative', 'daily brief', and similar short requests that are likely to appear in unrelated chats. Because the skill then 'decides which Combo to use,' ambiguous language can cause overbroad activation and execution of multi-endpoint workflows the user did not explicitly request.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This command performs an authenticated request to the CT Monitor API using the bearer token from the environment. Because the skill encourages automation and broad triggers, it can cause unauthorized or unintended authenticated external access and incur cost or expose private account usage patterns.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

Step 1: Get AI comprehensive briefing

bash

curl -s "https://api.ctmon.xyz/api/brief/generate?hours=24" \
  -H "Authorization: Bearer $CT_MONITOR_API_KEY" | jq '.report'

⚠️ Response structure: {"report": "...", "hours": N, "tweet_count": N, "generated_at": "..."} — always extract .report (the Markdown string). If you receive the full JSON object instead of a string, the data is intact; re-extract with | jq '.report'.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The skill issues another authenticated request to an external service with the environment token. In this context, the risk is compounded because multiple such calls are chained together automatically in a single combo, multiplying exposure and cost when invoked unintentionally.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

Step 2: Trending tokens + KOL mention analysis

bash

curl -s "https://api.ctmon.xyz/api/price/trending?hours=24" \
  -H "Authorization: Bearer $CT_MONITOR_API_KEY" | jq '.'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This step transmits an authenticated request to retrieve recent signals. The issue is not the endpoint itself but the pattern of unconditional bearer-token use across many user-driven flows, which increases the blast radius of accidental skill activation.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

Step 3: Last 6h high-frequency signals

bash

curl -s "https://api.ctmon.xyz/api/signals/recent?hours=6&min_score=60" \
  -H "Authorization: Bearer $CT_MONITOR_API_KEY" | jq '.'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

Authenticated outbound access to market summary data is performed automatically as part of combo execution. Because the skill is designed for scheduled automation and ambiguous invocation phrases, this can lead to repeated unintended authenticated traffic to the provider.

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

Step 4: Market overview + news feed (with source attribution)

bash

curl -s "https://api.ctmon.xyz/api/price/summary" \
  -H "Authorization: Bearer $CT_MONITOR_API_KEY" | jq '.'

curl -s "https://api.ctmon.xyz/api/info/feed?limit=30" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This authenticated request to the news feed endpoint is another instance of secret-bearing external transmission. The repetition throughout the file shows a systematic pattern of sending the bearer token to a remote service whenever analysis is requested.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

curl -s "https://api.ctmon.xyz/api/price/summary"
-H "Authorization: Bearer $CT_MONITOR_API_KEY" | jq '.'

curl -s "https://api.ctmon.xyz/api/info/feed?limit=30"
-H "Authorization: Bearer $CT_MONITOR_API_KEY" | jq '[.[] | select(.score >= 50)] | sort_by(-.score)'

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The skill sends data to external third-party infrastructure (Binance Web3) as part of its workflow. Even though the sample payload is static, the skill normalizes routine external transmissions and combines them with user-driven analysis paths, which can expose usage patterns and create dependency on untrusted remote content for synthesis.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

Step 5: Binance Smart Money Signals — 聪明钱最新买卖信号

bash

curl -s -X POST 'https://web3.binance.com/bapi/defi/v1/public/wallet-direct/buw/wallet/web/signal/smart-money' \
  -H 'Accept-Encoding: identity' \
  -H 'Content-Type: application/json' \
  -d '{"smartSignalType":"","page":1,"pageSize":10,"chainId":"CT_501"}' | jq '.data[:10]'

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The language rule requires the report to be written entirely in whatever language the system infers from context, including "If the user writes in Chinese, the full report must be in Chinese" and "Never mix languages." This forces a locale/language choice based on inference rather than explicit user preference or opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The trending-token workflow makes authenticated outbound requests to a remote API. In aggregate with the rest of the skill, this means even simple exploratory prompts can trigger multiple external calls using a secret from the environment.

Content

Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.

Step 1: Trending tokens — KOL mentions + CoinGecko rank + price

bash

curl -s "https://api.ctmon.xyz/api/price/trending?hours=24" \
  -H "Authorization: Bearer $CT_MONITOR_API_KEY" | jq '.'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This authenticated signals query contributes to a broad pattern of external token-bearing calls. Since the skill can autonomously choose combos from ambiguous prompts, users may cause billable or privacy-impacting requests without intending to.

Content

Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.

Step 2: Alpha signals — check if KOL consensus has formed

bash

curl -s "https://api.ctmon.xyz/api/signals/recent?hours=6&min_score=60" \
  -H "Authorization: Bearer $CT_MONITOR_API_KEY" | jq '.'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The news feed request sends an Authorization header to the CT Monitor service. The danger is heightened by the skill's automation examples, which normalize repeated scheduled authenticated transmissions to external infrastructure.

Content

Scanner excerpt · SKILL.md (reported line 228)May include surrounding context.

Step 3: News feed — check media coverage for hot tokens

bash

curl -s "https://api.ctmon.xyz/api/info/feed?limit=30" \
  -H "Authorization: Bearer $CT_MONITOR_API_KEY" | jq '.'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This market baseline query is another authenticated external call. The security concern is systemic: the skill converts normal chat intents into remote token-authenticated requests with little friction.

Content

Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.

Step 4: Market baseline — BTC/ETH price to judge relative strength

bash

curl -s "https://api.ctmon.xyz/api/price/summary" \
  -H "Authorization: Bearer $CT_MONITOR_API_KEY" | jq '.'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This workflow invokes a Binance third-party ranking API and incorporates the response into generated output. External transmission itself is expected for this skill, but it remains a true risk because it broadens the trust boundary and may leak behavioral metadata about user requests to additional services.

Content

Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.

Step 5: Binance Unified Token Rank — 链上 Trending/Alpha 排名

bash

curl -s -X POST 'https://web3.binance.com/bapi/defi/v1/public/wallet-direct/buw/wallet/market/token/pulse/unified/rank/list' \
  -H 'Accept-Encoding: identity' \
  -H 'Content-Type: application/json' \
  -d '{"page":1,"pageSize":20}' | jq '.data.tokens[:10]'

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This instruction mandates that the report be entirely in the detected user language and prohibits mixing languages. That is a language-policy constraint imposed by the skill without offering the user a choice or opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The alpha-discovery step sends an authenticated request and processes the remote response with further automated logic. In context, this can trigger chained calls and analysis based on untrusted external content, all under an ambient bearer token.

Content

Scanner excerpt · SKILL.md (reported line 306)May include surrounding context.

Step 1: Discover alpha signals — filter out majors, focus on altcoins/memes

bash

curl -s "https://api.ctmon.xyz/api/signals/recent?hours=6&min_score=60" \
  -H "Authorization: Bearer $CT_MONITOR_API_KEY" | \
  jq '[.[] | select(.keyword | ascii_downcase | test("btc|eth|sol|xrp|bnb|usdc|usdt|ada|ltc") | not)]'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This price query transmits an authenticated request keyed by a token symbol derived from prior remote data. The chaining makes the workflow more dangerous because untrusted upstream data influences subsequent outbound requests.

Content

Scanner excerpt · SKILL.md (reported line 316)May include surrounding context.

Step 2: Query token price and momentum (replace TOKEN with the symbol from Step 1's top signal)

bash

curl -s "https://api.ctmon.xyz/api/price/token?symbol=TOKEN" \
  -H "Authorization: Bearer $CT_MONITOR_API_KEY" | jq '.'

Use the actual token symbol from Step 1 (strip $ prefix, e.g. $PENGU → PENGU).