ClawHub
Back to skill

Security audit

X Helper

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed X/Twitter automation helper with powerful account actions, but I found no hidden exfiltration, deceptive behavior, or unrelated persistence.

Install only if you are comfortable giving the skill X account authority. Use a least-privileged token, confirm every post/DM/delete/follow/block/publish action before it runs, avoid sensitive DMs or media, and clear ~/.x-helper/auth.json with auth logout if you use OAuth authorization.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Intent-Code Divergence

Medium
Confidence
86% confidence
Finding
The documentation makes a trust-relevant claim that the cached OAuth token file will not be used for requests, but later states token auto-refresh uses local JSON storage. That inconsistency can mislead users about where credentials are read from and persisted, which matters because the skill handles high-value X API tokens and performs network actions on the user's behalf.

Vague Triggers

Medium
Confidence
93% confidence
Finding
A broad natural-language trigger for posting can cause the assistant to map ordinary conversation into a real write action on the user's X account. In this skill context, that is especially dangerous because posting is externally visible, potentially irreversible, and can expose sensitive or reputationally damaging content if the trigger is matched incorrectly.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The article-drafting trigger is vague enough that a generic request for writing help could be interpreted as invoking the X article workflow. Even if drafting is less severe than immediate posting, it still routes user content into a platform-specific action path and increases the chance of accidental preparation or later publication of unintended material.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:50