ClawHub
Back to skill

Security audit

X Helper

Security checks for vulnerabilities and agentic risk

Overview

This X helper is mostly coherent, but it needs review because many account-changing X actions can run without enforced confirmation and OAuth material is cached in plaintext.

Install only if you are comfortable granting this skill broad control over an X account. Use the least-privileged token possible, avoid sensitive accounts, review every generated command before running it, and treat ~/.x-helper/auth.json as a secret if you use OAuth authorization.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/x_client.py:604
Finding

State-changing X operations execute without the declared user confirmation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/x_auth.py:159
Finding

OAuth client secret and unnecessary PKCE material are stored in plaintext

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (33)

Tainted flow: 'req' from os.environ.get (line 132, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/x_client.py (reported line 134)May include surrounding context.

python
for attempt in range(3):
        req = urllib.request.Request(url, data=data, headers=headers, method=method)
        try:
            with urllib.request.urlopen(req, timeout=30) as resp:
                raw = resp.read().decode()
                return json.loads(raw) if raw else {}
        except URLError as e:

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description presents a full-featured X assistant with extensive end-user capabilities. The supplied code chunk does not implement those features; instead, it serves as a diagnostic/setup checker for the environment and authentication state. While this may be a supporting component of such a skill, the actual behavior of this chunk is materially different from the declared primary purpose. It also accesses local auth data and runs a subprocess to validate authentication, which are not reflected in the description. Therefore this code chunk does not accurately match the declared description.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The description claims a comprehensive X assistant with many user-facing platform operations. The supplied code does not implement those actions; it is a narrow auth helper responsible for OAuth PKCE flow, token exchange, token persistence, status reporting, and credential deletion. While authentication is a plausible supporting component of an X assistant, the declared purpose does not accurately represent this chunk's actual primary behavior. Therefore this chunk is materially mismatched with the stated description.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The feature coverage largely matches the declared purpose: the code genuinely acts as an X assistant with search, posting, threads, DMs, Lists, bookmarks, trends, articles, block/mute, and more. There is no obvious unrelated or hidden capability beyond X API interactions. The main mismatch is in the implementation description: it is not strictly 'Pure Python stdlib, no dependencies' because this file depends on non-stdlib modules x_auth and x_media. In addition, the auth description in _get_token says this skill never requests, stores, or refreshes tokens itself and only uses X_BEARER_TOKEN, yet the CLI advertises auth authorize/status/logout commands that rely on another module, making the authentication behavior only partially represented by this code chunk. So the primary purpose matches, but the declared self-contained/stdlib-only representation is materially inaccurate.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The description claims a full-featured X assistant with many capabilities, but the supplied code only implements media uploading. While 'post with media' is related, this chunk does not perform posting itself and does not implement the many other declared capabilities. There is no evidence of undeclared malicious behavior; the issue is that the declared purpose is materially broader than the actual behavior of this code chunk.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md
python3 scripts/x_client.py auth authorize --client-id YOUR_CLIENT_ID

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
python3 scripts/x_client.py auth authorize --client-id YOUR_CLIENT_ID

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 263)May include surrounding context.

md
python3 scripts/x_client.py auth authorize --client-id YOUR_CLIENT_ID

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

md
python3 scripts/x_client.py auth authorize --client-id YOUR_CLIENT_ID

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.

md
python3 scripts/x_client.py auth authorize --client-id YOUR_CLIENT_ID

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 269)May include surrounding context.

md
python3 scripts/x_client.py auth authorize --client-id YOUR_CLIENT_ID

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/x_client.py (reported line 89)May include surrounding context.

python
# ── Auth ──────────────────────────────────────────────────────────────────

def _get_token():
    """Get the access token.

    The token comes ONLY from the user-set X_BEARER_TOKEN env var. The user
    manages this credential themselves (e.g. `export X_BEARER_TOKEN=...`);

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill documentation, triggers, and behavioral rules are written entirely in Chinese, which implicitly enforces a specific language for interaction and understanding. The file does not indicate that users may choose another language or that the Chinese locale is a required, justified constraint for a region-specific tool.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation makes conflicting claims about whether cached OAuth tokens are automatically read and refreshed from local JSON storage. This can cause operators to make unsafe assumptions about where credentials reside and when they are used, increasing the risk of inadvertent credential exposure, persistence, or use in automation contexts handling sensitive data.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/setup.py (reported line 64)May include surrounding context.

python
if auth_ok:
                print(f"     用户: @{auth.get('username')} ({auth.get('user_name')})")
                expires = auth.get("expires_at", 0)
                remaining = max(0, expires - int(__import__('time').time()))
                print(f"     Token 剩余: {remaining // 60} 分钟")
            else:
                missing = []

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/setup.py (reported line 93)May include surrounding context.

python
print()
        print("  测试认证...")
        try:
            result = subprocess.run(
                [sys.executable, CLIENT_SCRIPT, "auth", "status"],
                capture_output=True, text=True, timeout=10
            )

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The helper requests a broad set of write-capable scopes plus offline.access, which increases blast radius if the stored token is stolen or misused. In an agent skill that can act on a user's social account, overbroad OAuth scope violates least privilege and makes any downstream compromise more damaging.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The helper requests a broad set of write-capable scopes plus offline.access, which increases blast radius if the stored token is stolen or misused. In an agent skill that can act on a user's social account, overbroad OAuth scope violates least privilege and makes any downstream compromise more damaging.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code persists OAuth credentials, including access/refresh token material and potentially client_secret, to disk automatically without explicit user warning or consent. Although file permissions are restricted, local malware, backup/sync leakage, shared-account usage, or later accidental exposure can lead to account takeover or long-lived unauthorized access due to offline.access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The client includes a confirmation helper for irreversible actions, but tweet deletion does not use it before issuing a DELETE request. In an agent or scripted context, this increases the chance of accidental destructive actions from prompt mistakes, argument confusion, or automation errors.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The _get_token docstring says the skill 'never requests, stores, or refreshes tokens on the user's behalf,' presenting a no-auth-management intent. But cmd_auth exposes authorize, status, and logout flows via x_auth, and the usage banner instructs users to run auth authorize to obtain a token, which directly contradicts that statement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

List deletion is irreversible and is performed immediately without any explicit confirmation gate. In an agent-operated skill, that makes unintended destructive actions more likely, especially if commands are generated automatically from natural-language requests.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/x_auth.py (reported line 26)May include surrounding context.

python
import urllib.parse
from urllib.error import URLError

MEDIA_UPLOAD_URL = "https://api.x.com/2/media/upload"
FILE_SIZE_LIMIT_SIMPLE = 5 * 1024 * 1024  # 5 MB for simple upload
MAX_RETRIES = 5
POLL_INTERVAL = 2

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/x_auth.py (reported line 182)May include surrounding context.

python
import urllib.parse
from urllib.error import URLError

MEDIA_UPLOAD_URL = "https://api.x.com/2/media/upload"
FILE_SIZE_LIMIT_SIMPLE = 5 * 1024 * 1024  # 5 MB for simple upload
MAX_RETRIES = 5
POLL_INTERVAL = 2