Kiro X Publisher

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:49 PM UTC
• Version: 1.1.0

Overview

The skill mostly matches its X trend-and-posting purpose, but its cron helper can create recurring public X posts without an extra confirmation or clear removal path.

Review carefully before installing. Use draft-only runs first, avoid running scripts/setup_cron.sh unless you intentionally want recurring public X posts, and use narrowly scoped X credentials. Be aware that tweet URLs are sent to FxTwitter during enrichment and that generated outputs are saved under outputs/x-hot by default.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: scripts/setup_cron.sh:65

Finding

Persistent Scheduled Task Enables Autonomous X Account Posting

Content

View full analysis

Vulnerability Details

File Location: scripts/setup_cron.sh:65-77; additional example at examples/cron_command.txt:2-9
Vulnerability Type: Persistent scheduled task with automatic posting privileges
Risk Level: High

Vulnerable Code

scripts/setup_cron.sh:65-77:

bash

# Escape single quotes defensively for the command text passed to cron.
SAFE_QUERIES="${QUERIES//\'/\'\\\'\'}"
MESSAGE="Run: python3 skills/kiro-x-hot-publisher/scripts/x_hot_pipeline.py --queries '$SAFE_QUERIES' --batch-size $BATCH --post"

echo "[x-hot] using node: $NODE22_BIN"
"$NODE22_BIN" openclaw.mjs --profile "$PROFILE" cron add \
  --name "$JOB_NAME" \
  --cron "$CRON_EXPR" \
  --tz "$TZ_NAME" \
  --session isolated \
  --message "$MESSAGE" \
  --no-deliver

echo "[x-hot] cron job created"
"$NODE22_BIN" openclaw.mjs --profile "$PROFILE" cron list

examples/cron_command.txt:2-9:

bash

# Daily 09:00 Asia/Shanghai, run pipeline and post 1 tweet
openclaw cron add \
  --name "Daily Kiro X Hot Publisher" \
  --cron "0 9 * * *" \
  --tz "Asia/Shanghai" \
  --session isolated \
  --message "Run: python3 skills/kiro-x-hot-publisher/scripts/x_hot_pipeline.py --queries \"AI,OpenAI,DeepSeek,Claude,Gemini\" --batch-size 10 --post" \
  --no-deliver

Technical Analysis

The setup script registers a recurring OpenClaw cron job that survives the setup process and executes in future sessions. The stored command unconditionally includes --post, causing each scheduled invocation to generate and publish a tweet through the X API.

Although scheduled publishing is part of the Skill's declared optional functionality, the helper does not default to draft-only operation or separately require explicit authorization for recurring publication. Running the helper therefore creates persistent autonomous behavior with the authority to publish using the X OAuth credentials available to the scheduled session.

...[truncated 1886 chars]

Remediation

View remediation

Remediation Suggestions

1. Make scheduled execution draft-only by default and omit --post from the generated cron message.
2. Require a separate explicit option, such as --enable-scheduled-posting, before adding --post.
3. Display the exact schedule and command, explain that it persists across sessions, and require interactive confirmation before registration.
4. Add an approval gate for every generated tweet so scheduled runs cannot publish without user review.
5. Document and provide a safe command or helper to list and remove the installed scheduled task.
6. Use narrowly scoped X credentials and restrict them to only the permissions required for posting.
7. Clearly document the task name, profile, schedule, timezone, notification behavior, credential requirements, and persistence implications.
8. Consider enabling execution notifications rather than using --no-deliver, allowing users to detect unexpected scheduled activity.
9. Protect the scheduled script and workspace against unauthorized modification because the persistent task will execute future versions of the referenced pipeline.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented behavior does not fully match the effective behavior: it relies on an undeclared third-party enrichment service, writes output files locally, and can authenticate and post to X, while also claiming optional scheduled publishing that is not actually implemented here. This mismatch is dangerous because users may grant secrets or run the skill under false assumptions about data flows, side effects, and external disclosures.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises capabilities that include network access, environment-variable use, and filesystem writes, but it does not declare any explicit tool scope or permissions. That makes the trust boundary unclear for reviewers and users, increasing the chance that sensitive credentials are exposed to code paths or actions they did not knowingly authorize.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The examples encourage use of the --post flag without a prominent warning that it will publish to a live public X account. In this context, the skill generates content automatically from aggregated signals, so accidental execution could cause unintended public posts, reputational harm, or posting from the wrong account if credentials are present.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This script creates a persistent scheduled cron job immediately when run, with no interactive confirmation, dry-run mode, or prominent warning that it is modifying scheduler state. In the context of a social-media publishing skill, this is security-relevant because it can automate future execution and posting behavior beyond the user's immediate intent, making accidental persistence and misuse more likely.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The code performs an outbound request to a third-party domain, api.fxtwitter.com, using URLs derived from discovered tweets. While the destination is hardcoded rather than attacker-controlled, this is still a real external data transmission risk because the skill shares collected social-media targets and retrieves processed content from a non-X service outside the primary trust boundary.

Content

Scanner excerpt · scripts/x_hot_pipeline.py (reported line 155)May include surrounding context.

python

def enrich_with_fxtwitter(url: str) -> Dict[str, Any]:
    username, tweet_id = parse_tweet_url(url)
    api_url = f"https://api.fxtwitter.com/{username}/status/{tweet_id}"
    req = urllib.request.Request(api_url, headers={"User-Agent": "Mozilla/5.0"})
    with urllib.request.urlopen(req, timeout=15) as resp:
        data = json.loads(resp.read().decode("utf-8"))

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

If the top content is detected as mostly CJK, the script automatically switches the generated draft to Chinese. This imposes a language choice based on content heuristics rather than explicit user preference, which is a natural-language locale policy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The enrichment step sends each discovered tweet URL to api.fxtwitter.com, disclosing user-selected monitoring targets and causing third-party processing of tweet-associated content without any user disclosure or consent gate. In a social-media monitoring skill, that external transmission can leak research interests, tracked accounts, and content context to an unrelated service, which is especially risky in enterprise or sensitive workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

When run with --post, the script attempts to publish directly to X using whatever draft text was generated or supplied via --draft-text, without any interactive confirmation, dry-run default, or prominent warning in the publish path. In an agent skill that can be invoked autonomously or scheduled, this increases the risk of unintended public posting, reputational harm, and accidental misuse of write-scoped credentials.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.