ClawHub
Back to skill

Security audit

readx

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real Twitter/X analysis integration, but it asks agents to handle and persist API keys in risky ways that users should review before installing.

Install only if you are comfortable giving this skill a readx API key and allowing it to store that key in local/editor configuration. Prefer using a platform secret store or environment variable, avoid putting long-lived keys in URLs when possible, and rotate the key if it has been copied into shell history or shared configs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:69
Finding

API Key Exposed Through URL Query Parameters

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:69; corroborating setup examples at README.md:27 and README.md:34
Vulnerability Type: Credential exposure through insecure configuration
Risk Level: Medium

Vulnerable Code

SKILL.md:69:

text
MCP server URL: `https://readx.cc/mcp?apikey=<API_KEY>`

README.md:27:

bash
claude mcp add --transport http readx -s user https://readx.cc/mcp?apikey=<API_KEY>

README.md:30-36:

json
{
  "mcpServers": {
    "readx": {
      "url": "https://readx.cc/mcp?apikey=<API_KEY>"
    }
  }
}

Technical Analysis

The Skill instructs users to embed a long-lived API key directly in an MCP URL query parameter. Although transmitting the key to readx.cc is required for the declared service, query-string authentication exposes the credential to more components than necessary.

The URL may be retained in:

  • Shell command history
  • Editor or MCP configuration files
  • Process arguments and local diagnostic output
  • Client, proxy, CDN, or server access logs
  • Error reports and telemetry containing complete request URLs

HTTPS protects the URL while it is in transit but does not prevent disclosure through these local or server-side records. The behavior therefore exceeds minimum necessary credential exposure even though it does not constitute deliberate exfiltration to an unrelated domain.

Attack Path

  1. A user substitutes their real API key into the documented MCP URL.
  2. The user executes the setup command or saves the URL in an editor configuration.
  3. The complete URL is recorded in shell history, configuration, process telemetry, request logs, or diagnostics.
  4. An attacker or lower-privileged user obtains access to one of those records.
  5. The attacker extracts the query parameter and authenticates to readx.cc as the victim.

Impact Assessment

Successful exploitation grants th ...[truncated 434 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace query-string authentication with an Authorization: Bearer header or another header-based authentication mechanism.
  • Configure the MCP client to obtain the key from a protected environment variable or secret store rather than interpolating it into a URL.
  • Ensure credential files use restrictive permissions, such as owner-only access on supported systems.
  • Avoid placing secrets directly in command-line arguments, examples, diagnostic output, or ordinary editor configuration.
  • Redact query strings and authorization data from client, proxy, CDN, and server logs.
  • Provide documented key revocation and rotation procedures for users who may have followed the current setup instructions.
  • If the MCP protocol requires a URL credential, use a short-lived, narrowly scoped token and exchange it for a session credential rather than exposing a persistent API key.

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:98
Finding

Mutable Remote Documentation Is Treated as Operational Agent Guidance

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:98-104
Vulnerability Type: Indirect instruction injection through remotely mutable content
Risk Level: Medium

Vulnerable Code

markdown
### API Reference

Fetch the full API docs (endpoints, params, response parsing, examples):

```bash
curl -s https://readx.cc/api-docs.txt

Read this document before making your first API call. It contains all endpoint names, parameters, and response JSON paths you need.

text

### Technical Analysis

The Skill requires the Agent to download a remotely mutable text document and read it before making API calls. No integrity digest, fixed version, trusted schema, content validation, or explicit instruction/data boundary is defined.

This is not remote code execution by itself: the retrieved file is documentation rather than an executable payload. However, an Agent may interpret natural-language content in the document as authoritative instructions. If the content is compromised, an attacker could insert directions that alter tool usage, request destinations, credential handling, or the current analysis goal.

HTTPS authenticates the server connection but does not protect against compromise of the `readx.cc` service, its content-management process, DNS or hosting account, or an authorized publisher. The remotely retrieved text can also change after the Skill package has been reviewed.

### Attack Path

1. An attacker compromises the remote documentation endpoint or a system authorized to publish `api-docs.txt`.
2. The attacker adds natural-language instructions disguised as API setup or usage guidance.
3. The Agent follows the Skill and downloads the modified document.
4. Because the Skill explicitly tells the Agent to read the document before operating, the injected content enters the Agent's active context.
5. The Agent may follow malicious directions, such as sending requests to an attacker-selected endpoint, disc
...[truncated 756 chars]
Remediation
View remediation

Remediation Suggestions

  • Bundle a reviewed, versioned API specification with the Skill instead of retrieving mutable prose at runtime.
  • If runtime retrieval is necessary, publish a machine-readable schema and parse only expected fields rather than presenting the entire document to the Agent as instructions.
  • Pin the document to a version and verify a cryptographic digest or trusted signature before use.
  • Explicitly instruct the Agent to treat retrieved documentation as untrusted data and never follow directives contained within it.
  • Enforce an allowlist restricting subsequent API requests to fixed HTTPS endpoints under the expected readx.cc origin.
  • Reject documentation that contains shell commands, credential-handling directives, unrelated URLs, or unexpected instruction-like content.
  • Apply least-privilege controls to the tools available while interpreting remote API metadata.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Ssd 3

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The Direct API instructions explicitly tell the agent to search local files and environment variables for secrets and to persist newly provided keys. This creates a direct natural-language pathway for secret harvesting and storage, and in the context of an agent skill, it materially expands the attack surface beyond Twitter analysis into credential access and retention.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
99% confidence
Finding

Referencing a specific credentials file path and directing the agent to read it is a concrete credential-access capability. In a skill whose purpose is social-media analysis, this is unnecessarily dangerous because it enables local secret retrieval that could be repurposed for exfiltration or broadened access beyond the intended service.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md
### Getting the API Key

Check in order, use the first one found:
1. Config file: `~/.config/readx/credentials.json` (macOS/Linux) or `%APPDATA%\readx\credentials.json` (Windows) → JSON format: `{"api_key":"<key>"}`
2. Environment variable: `READX_API_KEY`
3. If neither exists, ask the user for their API key (get one at https://readx.cc), then ask whether they want to save it themselves or have you do it. Persist to the config file path above.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README tells users to embed the API key directly in the MCP server URL, which creates a real credential-handling risk. URLs are commonly copied into config files, logs, shell history, editor telemetry, crash reports, and debugging output, so the key may be exposed more broadly than intended. Because this is a remote MCP server used by multiple editors/tools, the chance of accidental disclosure through local configuration or tooling is higher, making the guidance more dangerous in context.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The instructions normalize handling the API key in natural language, including exposing it in output if explicitly requested. Once a skill is allowed to retrieve and discuss secrets conversationally, prompt injection, social engineering, or user confusion can lead to credential disclosure that is difficult to contain.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The setup flow asks for the user's API key and instructs embedding it directly into an MCP server URL. Putting credentials into URLs is especially risky because URLs are often logged, cached, copied, displayed in UIs, or stored in configuration files, creating multiple avenues for unintended disclosure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly authorizes the agent to modify the user's MCP configuration and insert an API key into a server URL, which exceeds a pure Twitter/X analytics function. Even with nominal user consent, granting configuration-writing and credential-persistence behavior increases the chance of unsafe secret handling, accidental credential exposure, and unauthorized local state changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger conditions are broad enough that routine mentions of Twitter analysis or transient tool failures could launch setup flows that ask for credentials or reconfigure tooling. This increases the likelihood of unnecessary secret collection and unplanned side effects in situations where the user did not clearly request setup assistance.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The Direct API Mode tells the agent to inspect local credential files, read environment variables, and write API keys back to disk. That is secret-management functionality unrelated to the core analytics purpose and creates a broad capability to access, collect, and persist sensitive data that could be abused or mishandled.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill instructs the agent to save API credentials to disk but does not present a strong, prominent warning about the sensitivity of the data or safer alternatives. This encourages casual persistence of secrets in user-accessible locations, increasing the risk of leakage through filesystem exposure, backups, logs, or later agent access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.