X use

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:31 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed Twitter/X collection helper, but users should understand it relies on a third-party CLI and an authenticated browser session.

Install only if you trust the site-use npm package and are comfortable logging into X in an isolated Chrome profile. Live timeline fetches, searches, tweet lookups, and screenshots may expose account-linked activity to X and store collected posts locally; use cache-only commands when you do not want a live browser fetch.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4

Finding

Unpinned Third-Party Executable Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

yaml

metadata: { "openclaw": { "emoji": "🌐", "homepage": "https://github.com/WilliamPenrose/site-use", "requires": { "bins": ["site-use"] }, "install": [{ "kind": "node", "package": "site-use", "bins": ["site-use"] }] } }

Technical Analysis

The skill declares installation of the third-party npm package site-use without specifying an exact version or integrity hash. Consequently, installation can resolve to a mutable package release whose source was not included in the audited project.

The installed CLI is subsequently trusted to launch and control an isolated Chrome profile, interact with an authenticated Twitter/X session, capture screenshots, and store or query collected posts. Although no malicious implementation is present in the reviewed file, executing an unpinned package creates a supply-chain trust boundary: a compromised publisher account, malicious future release, registry compromise, or dependency takeover could cause arbitrary package code to execute with the privileges of the agent process.

Attack Path

1. An attacker compromises the site-use package, its publisher account, or a transitive dependency and publishes a malicious release.
2. The skill installation resolves the unversioned package reference to that release.
3. Package installation hooks or the site-use executable run attacker-controlled code locally.
4. The code inherits the permissions and environment of the agent process.
5. When the browser workflow is used, the malicious package may access the isolated browser profile, authenticated Twitter/X session, screenshots, cached posts, and other resources available to that process.

This path depends on an upstream supply-chain compromise; the audited project does not itself contain evidence that the current package is malicious.

Impact

...[truncated 494 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin site-use to a reviewed, exact package version rather than using an unconstrained package reference.
2. Commit and enforce a package lockfile containing registry integrity hashes.
3. Verify the package publisher, canonical registry location, source repository, release provenance, and signatures before installation.
4. Review the pinned package and its transitive dependencies, including npm lifecycle scripts.
5. Disable lifecycle scripts during installation where they are unnecessary, or explicitly allow only reviewed scripts.
6. Consider vendoring the reviewed implementation or including auditable source with the skill.
7. Run the CLI in a sandbox with minimum filesystem, environment-variable, browser-profile, and network access.
8. Restrict access to the isolated browser profile and remove it when no longer required.
9. Use automated dependency monitoring while requiring explicit review before version upgrades.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to launch a browser, have the user log into Twitter, and perform searches/fetches tied to that authenticated session, but it does not clearly warn that queries and browsing activity will be transmitted to Twitter/X under the user's logged-in account. In this context, the omission matters because the tool handles potentially sensitive searches and personalized timeline access, so users may unknowingly expose account-linked activity and interests to a third party.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.