Monitor X posts

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:07 PM UTC
• Version: 1.0.0

Overview

The skill’s X monitoring purpose is mostly coherent, but it needs Review because it can create recurring agent-run cron jobs that use an X API token and process untrusted tweet text without clear permission boundaries.

Install only if you are comfortable storing an X API bearer token locally and creating recurring scheduled agent runs. Before enabling cron jobs, restrict the token to the minimum X API scopes, store credentials with private file permissions, confirm what tools scheduled agentTurn jobs can access, and add clear rules that tweet content must be treated as untrusted quoted data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/fetch-tweets.py:64

Finding

Untrusted Tweet Content Is Passed to the Agent Without Instruction-Boundary Safeguards

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:12

Finding

Plaintext Bearer Token Storage Lacks Required Filesystem Permission Controls

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The document claims filtering, exclusion rules, schedule management, and handle management behaviors that are not actually implemented in the supplied skill content, while also persisting local state not clearly disclosed in the high-level description. This mismatch can mislead users and reviewers about what the skill really does, reducing trust and making risky behavior like local persistence or automation easier to hide.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

# Config paths
BASE_DIR = Path.home() / '.openclaw' / 'workspace' / 'x-monitor'
CREDS_FILE = BASE_DIR / 'credentials.json'
HANDLES_FILE = BASE_DIR / 'handles.json'
LAST_CHECK_FILE = BASE_DIR / 'last-check.json'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

md

# Config paths
BASE_DIR = Path.home() / '.openclaw' / 'workspace' / 'x-monitor'
CREDS_FILE = BASE_DIR / 'credentials.json'
HANDLES_FILE = BASE_DIR / 'handles.json'
LAST_CHECK_FILE = BASE_DIR / 'last-check.json'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch-tweets.py (reported line 13)May include surrounding context.

python

# Config paths
BASE_DIR = Path.home() / '.openclaw' / 'workspace' / 'x-monitor'
CREDS_FILE = BASE_DIR / 'credentials.json'
HANDLES_FILE = BASE_DIR / 'handles.json'
LAST_CHECK_FILE = BASE_DIR / 'last-check.json'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch-tweets.py (reported line 100)May include surrounding context.

python

# Config paths
BASE_DIR = Path.home() / '.openclaw' / 'workspace' / 'x-monitor'
CREDS_FILE = BASE_DIR / 'credentials.json'
HANDLES_FILE = BASE_DIR / 'handles.json'
LAST_CHECK_FILE = BASE_DIR / 'last-check.json'

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill instructs the agent to read/write local files and make network calls to the X API, but it declares no explicit tool scope or permissions boundary. That increases the chance the agent will exercise broader capabilities than users expect, especially when combined with automation and credential handling.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill directs the agent to set up cron jobs, introducing persistent scheduled execution rather than a one-shot monitoring action. Persistent automation broadens the attack surface because it can continue making network requests and processing data without a fresh user approval each time.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Using agentTurn-based cron payloads creates a durable automation channel that can repeatedly invoke the agent with tools and context over time. Even if intended for monitoring, this capability is broader than the stated purpose and can amplify mistakes, misconfigurations, or later prompt manipulation into recurring actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/fetch-tweets.py (reported line 30)May include surrounding context.

python

def fetch_recent_tweets(handle, bearer_token, since_time=None):
    """Fetch recent tweets from a handle using X API v2."""
    url = 'https://api.x.com/2/tweets/search/recent'
    
    query = f'from:{handle}'
    if since_time:

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The documentation tells users to store an API bearer token in a local JSON file but does not warn about filesystem permissions, secret leakage, or avoiding accidental commits and exposure. While not an exploit by itself, poor secret-handling guidance increases the likelihood of credential compromise.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This JSON config fixes the skill's locale behavior to America/Los_Angeles. Under the policy, forcing a specific locale without user opt-in or clear justification can be a natural-language policy violation, and this file provides neither an alternative nor explanatory context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code loads credentials.json and accesses the bearer token to authenticate outbound API requests. While the module docstring says it fetches tweets, there is no explicit warning in this file about reading sensitive credentials from the user's home directory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script writes last-check.json and tweet_history.json under the user's home directory, persisting fetched content and metadata across runs. Although the code behavior is visible, there is no explicit user-facing disclosure in comments, docstrings, or output that the script creates and updates local history files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.