ClawHub
Back to skill

Security audit

X Search (Grok API)

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed X/Twitter search helper that sends user-requested searches to xAI and can optionally save or schedule results, with manageable setup and privacy risks but no artifact-backed malicious behavior.

Install only if you are comfortable sending your X search prompts and xAI API key to xAI. Use a virtual environment, consider pinning `requests` and `pyyaml`, choose `--output` paths carefully because existing same-day files can be overwritten, and review any cron announcements before sending results to Telegram, Slack, or Discord.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Third-Party Python Dependencies

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (22)

Tainted flow: 'payload' from os.environ.get (line 60, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · x_search.py (reported line 69)May include surrounding context.

python
resp = None
    for attempt in range(3):
        try:
            resp = requests.post(API_URL, headers=headers, json=payload, timeout=120)
            if resp.ok:
                break
            print(f"API error {resp.status_code} (attempt {attempt+1}/3): {resp.text}", file=sys.stderr)

Self-Modification

High
Category
Rogue Agent
Confidence
93% confidence
Finding

The skill explicitly supports writing to arbitrary user-provided paths and overwriting same-day files, creating a real file-modification primitive. In an agent context, combining broad triggers, shell execution, and path-based output can lead to destructive overwrites of user content or persistence in unintended locations if the path is influenced by ambiguous prompts or unsafe automation.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
`--output` saves the result to a Markdown file (stdout is preserved):
- Pass a **directory** → auto-named file: `karpathy-2026-03-22.md`, `trends-AI-2026-03-22.md`, etc.
- Pass a **full path** → saved directly to that path
- Same-day runs overwrite the existing file (no duplicate accumulation)

`--progress-only` suppresses full Markdown on stdout — prints one summary line instead. Use with `--output` in automated pipelines (watchlist, cron) to avoid injecting large outputs into the agent context.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
91% confidence
Finding

The documentation reveals and encourages direct use of the agent's configuration/skills directory under ~/.claude, exposing internal layout and normalizing access to sensitive agent-local paths. In agent environments, this can expand the blast radius of path-based misuse, accidental disclosure, or chaining with other skills that can read or modify files in the same area.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

How to Run

Find the script at ~/.claude/skills/x-search/x_search.py (or the symlinked path).

bash
# Account mode — by time range

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

md
> **Note:** all accounts share the same execution parameters. For per-account customization, call `x_search.py` directly.

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · x_search.py (reported line 406)May include surrounding context.

python
parser.add_argument(
        "--output", "-o", default=None, metavar="PATH",
        help="Save output to file. Pass a directory for auto-naming, or a full path. "
             "Same-day runs overwrite the existing file.",
    )
    parser.add_argument(
        "--progress-only", action="store_true",

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file repeatedly uses Asia/Shanghai in scheduling examples and includes a --lang zh example, presenting a specific locale/language as the default pattern without offering choice or clarifying that these are merely sample values. This can violate language/locale policy when users are not given an explicit opt-in or alternative.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The examples use --announce --channel telegram --to ... and later document Slack and Discord delivery, which sends search results or notifications to third-party messaging platforms. The markdown does not warn users that scheduled output may be transmitted off-system to external services.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises and instructs use of environment variables, shell execution, network access, and file writing, but it does not declare any explicit tool scope or permissions boundary. In an agent ecosystem, this increases the chance the skill is invoked with broader capabilities than necessary, making unintended file writes, external requests, or command execution harder to constrain and audit.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The trigger language is broad and open-ended, so the skill may be auto-selected for loosely related requests involving X/Twitter accounts or searches. Over-broad invocation increases the chance an agent will perform network access, shell execution, and optional file writes when the user did not clearly request those side effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation states that '--lang' defaults to 'zh', which imposes a specific language choice unless the user overrides it. This is a locale/language policy concern because the skill does not indicate that the user is asked to choose or consent to that default.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
89% confidence
Finding

Persisting search results to disk creates session-to-session state that may contain sensitive queries, monitored accounts, or externally sourced content. In scheduled or automated use, this can accumulate durable artifacts that are later consumed by other tools or exposed to other users/processes, increasing privacy and integrity risks.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
`--output` saves the result to a Markdown file (stdout is preserved):
- Pass a **directory** → auto-named file: `karpathy-2026-03-22.md`, `trends-AI-2026-03-22.md`, etc.
- Pass a **full path** → saved directly to that path
- Same-day runs overwrite the existing file (no duplicate accumulation)

`--progress-only` suppresses full Markdown on stdout — prints one summary line instead. Use with `--output` in automated pipelines (watchlist, cron) to avoid injecting large outputs into the agent context.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
86% confidence
Finding

Referencing ~/.claude/skills/x-search leaks the existence and structure of the installed skills directory, which aids skill enumeration and environment fingerprinting. On its own this is moderate, but in a multi-skill or partially compromised environment it can help an attacker discover adjacent components to target.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

How to Run

Find the script at ~/.claude/skills/x-search/x_search.py (or the symlinked path).

bash
# Account mode — by time range

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The prescribed post-result question is written only in Chinese and is presented as the required follow-up, which can force a language choice on users who did not opt into Chinese. This conflicts with language/locale neutrality expectations unless the skill is explicitly scoped to Chinese users.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · watchlist.py (reported line 78)May include surrounding context.

python
def run(cmd: list[str]) -> None:
    print(f"\n→ {' '.join(cmd)}", file=sys.stderr)
    result = subprocess.run(cmd)
    if result.returncode != 0:
        print(f"  ✗ exited with code {result.returncode}", file=sys.stderr)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The CLI sets --lang to zh by default, which imposes a specific language choice when the user does not explicitly request one. This is a natural-language locale policy concern because the skill does not present a neutral default or require user opt-in for the forced language.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · x_search.py (reported line 33)May include surrounding context.

python
print("Error: 'requests' not installed. Run: pip install requests", file=sys.stderr)
    sys.exit(1)

API_URL = "https://api.x.ai/v1/responses"
# Default model. Override with XAI_MODEL env var to pin a specific version, e.g.:
#   export XAI_MODEL=grok-4
MODEL = os.environ.get("XAI_MODEL", "grok-4-1-fast-reasoning")

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · x_search.py (reported line 69)May include surrounding context.

python
resp = None
    for attempt in range(3):
        try:
            resp = requests.post(API_URL, headers=headers, json=payload, timeout=120)
            if resp.ok:
                break
            print(f"API error {resp.status_code} (attempt {attempt+1}/3): {resp.text}", file=sys.stderr)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The account-search function defaults the output language to "zh", which imposes a specific language choice unless the user explicitly overrides it. This is a natural-language policy concern because the skill sets a locale preference by default rather than prompting for or preserving user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The command-line interface sets --lang default to zh, meaning generated summaries/translations will be in Chinese unless the user notices and changes the flag. This forces a specific language by default and does not provide an opt-in language selection flow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill description repeatedly instructs users to save results to ~/obsidian/X/, which affects local user data by creating or updating files. The markdown does not include any warning or disclosure that scheduled runs will write to that directory automatically over time.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The manifest description frames the skill as a search tool that outputs Obsidian-ready Markdown, but the documented behavior includes persistent file writing via --output and batch/scheduled watchlist execution. Those behaviors go beyond a simple search-and-display description, even though they are documented elsewhere in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The comment shows a direct invocation example with --lang en, which prescribes English as the language setting. Because no alternative language choice, opt-in, or justification is provided in the file, this may violate the language/locale policy for natural-language instructions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.