Kiro X Publisher

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:49 PM UTC
• Version: 1.1.0

Overview

The skill mostly matches its X trend-and-posting purpose, but its cron helper can create recurring public X posts without an extra confirmation or clear removal path.

Review carefully before installing. Use draft-only runs first, avoid running scripts/setup_cron.sh unless you intentionally want recurring public X posts, and use narrowly scoped X credentials. Be aware that tweet URLs are sent to FxTwitter during enrichment and that generated outputs are saved under outputs/x-hot by default.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: scripts/setup_cron.sh:65
• Finding: Persistent Scheduled Task Enables Autonomous X Account Posting## Vulnerability Details **File Location**: `scripts/setup_cron.sh:65-77`; additional example at `examples/cron_command.txt:2-9` **Vulnerability Type**: Persistent scheduled task with automatic posting privileges **Risk Level**: High ### Vulnerable Code `scripts/setup_cron.sh:65-77`: ```bash # Escape single quotes defensively for the command text passed to cron. SAFE_QUERIES="${QUERIES//\'/\'\\\'\'}" MESSAGE="Run: python3 skills/kiro-x-hot-publisher/scripts/x_hot_pipeline.py --queries '$SAFE_QUERIES' --batch-size $BATCH --post" echo "[x-hot] using node: $NODE22_BIN" "$NODE22_BIN" openclaw.mjs --profile "$PROFILE" cron add \ --name "$JOB_NAME" \ --cron "$CRON_EXPR" \ --tz "$TZ_NAME" \ --session isolated \ --message "$MESSAGE" \ --no-deliver echo "[x-hot] cron job created" "$NODE22_BIN" openclaw.mjs --profile "$PROFILE" cron list ``` `examples/cron_command.txt:2-9`: ```bash # Daily 09:00 Asia/Shanghai, run pipeline and post 1 tweet openclaw cron add \ --name "Daily Kiro X Hot Publisher" \ --cron "0 9 * * *" \ --tz "Asia/Shanghai" \ --session isolated \ --message "Run: python3 skills/kiro-x-hot-publisher/scripts/x_hot_pipeline.py --queries \"AI,OpenAI,DeepSeek,Claude,Gemini\" --batch-size 10 --post" \ --no-deliver ``` ### Technical Analysis The setup script registers a recurring OpenClaw cron job that survives the setup process and executes in future sessions. The stored command unconditionally includes `--post`, causing each scheduled invocation to generate and publish a tweet through the X API. Although scheduled publishing is part of the Skill's declared optional functionality, the helper does not default to draft-only operation or separately require explicit authorization for recurring publication. Running the helper therefore creates persistent autonomous behavior with the authority to publish using the X OAuth credentials available to the scheduled session. ...[truncated 1886 chars]
• Remediation: ## Remediation Suggestions 1. Make scheduled execution draft-only by default and omit `--post` from the generated cron message. 2. Require a separate explicit option, such as `--enable-scheduled-posting`, before adding `--post`. 3. Display the exact schedule and command, explain that it persists across sessions, and require interactive confirmation before registration. 4. Add an approval gate for every generated tweet so scheduled runs cannot publish without user review. 5. Document and provide a safe command or helper to list and remove the installed scheduled task. 6. Use narrowly scoped X credentials and restrict them to only the permissions required for posting. 7. Clearly document the task name, profile, schedule, timezone, notification behavior, credential requirements, and persistence implications. 8. Consider enabling execution notifications rather than using `--no-deliver`, allowing users to detect unexpected scheduled activity. 9. Protect the scheduled script and workspace against unauthorized modification because the persistent task will execute future versions of the referenced pipeline.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior does not fully match the effective behavior: it relies on an undeclared third-party enrichment service, writes output files locally, and can authenticate and post to X, while also claiming optional scheduled publishing that is not actually implemented here. This mismatch is dangerous because users may grant secrets or run the skill under false assumptions about data flows, side effects, and external disclosures.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises capabilities that include network access, environment-variable use, and filesystem writes, but it does not declare any explicit tool scope or permissions. That makes the trust boundary unclear for reviewers and users, increasing the chance that sensitive credentials are exposed to code paths or actions they did not knowingly authorize.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The examples encourage use of the --post flag without a prominent warning that it will publish to a live public X account. In this context, the skill generates content automatically from aggregated signals, so accidental execution could cause unintended public posts, reputational harm, or posting from the wrong account if credentials are present.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This script creates a persistent scheduled cron job immediately when run, with no interactive confirmation, dry-run mode, or prominent warning that it is modifying scheduler state. In the context of a social-media publishing skill, this is security-relevant because it can automate future execution and posting behavior beyond the user's immediate intent, making accidental persistence and misuse more likely.

External Transmission

Medium

• Category: Data Exfiltration

Content

def enrich_with_fxtwitter(url: str) -> Dict[str, Any]:
    username, tweet_id = parse_tweet_url(url)
    api_url = f"https://api.fxtwitter.com/{username}/status/{tweet_id}"
    req = urllib.request.Request(api_url, headers={"User-Agent": "Mozilla/5.0"})
    with urllib.request.urlopen(req, timeout=15) as resp:
        data = json.loads(resp.read().decode("utf-8"))

• Confidence: 92% confidence
• Finding: The code performs an outbound request to a third-party domain, api.fxtwitter.com, using URLs derived from discovered tweets. While the destination is hardcoded rather than attacker-controlled, this is still a real external data transmission risk because the skill shares collected social-media targets and retrieves processed content from a non-X service outside the primary trust boundary.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: If the top content is detected as mostly CJK, the script automatically switches the generated draft to Chinese. This imposes a language choice based on content heuristics rather than explicit user preference, which is a natural-language locale policy issue.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The enrichment step sends each discovered tweet URL to api.fxtwitter.com, disclosing user-selected monitoring targets and causing third-party processing of tweet-associated content without any user disclosure or consent gate. In a social-media monitoring skill, that external transmission can leak research interests, tracked accounts, and content context to an unrelated service, which is especially risky in enterprise or sensitive workflows.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: When run with --post, the script attempts to publish directly to X using whatever draft text was generated or supplied via --draft-text, without any interactive confirmation, dry-run default, or prominent warning in the publish path. In an agent skill that can be invoked autonomously or scheduled, this increases the risk of unintended public posting, reputational harm, and accidental misuse of write-scoped credentials.

Static analysis

No suspicious patterns detected.