TweetClaw

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:47 AM UTC
• Version: 1.6.44

Overview

TweetClaw is a coherent X/Twitter automation guide with strong approval rules, but its default install path pulls an unpinned external plugin that would receive high-impact account permissions.

Read the approval and credential rules carefully before installing. Prefer a pinned, reviewed, signed or digest-verified release for real accounts, and only grant TweetClaw access to X/Twitter accounts where you are comfortable with approved posts, DMs, profile changes, private reads, exports, monitors, media handling, and prepaid-credit use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned External Plugin Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–26
Vulnerability Type: Unpinned executable dependency
Risk Level: Medium

Vulnerable Code

bash

openclaw plugins install clawhub:@xquik/tweetclaw

text

OpenClaw tracks the verified ClawHub package. Use
`openclaw plugins install npm:@xquik/tweetclaw` for the npm fallback.

Technical Analysis

The default and fallback installation instructions resolve @xquik/tweetclaw without an immutable version, artifact digest, or integrity hash. The project being audited contains only documentation, evaluations, and scan records; it does not include the plugin's executable source.

The externally installed plugin is expected to receive substantial capabilities, including injected Xquik authentication, network access, private X/Twitter reads, selected-media uploads, account writes, recurring monitor polling, and paid operations. Because the executable artifact is resolved after this Skill has been reviewed, its implementation can differ from the behavior described in SKILL.md.

Although lines 34–38 recommend pinning production installations, this does not secure the primary installation command. A version pin alone also does not provide the same immutability as a verified digest or signed artifact.

The static pre-scan's sensitive-network pattern is consistent with the declared functionality: the service must send user-requested X/Twitter data to Xquik. No covert transfer to an unrelated destination was identified in the available files. However, the absent runtime source prevents verification of the claimed endpoint restrictions, credential isolation, approval enforcement, and filesystem boundaries.

Attack Path

1. An attacker compromises the relevant ClawHub/npm publisher, registry artifact, release process, or transitive dependency.
2. A user follows the documented unpinned installation command.
3. OpenClaw resolves and installs the currently published, attacker-controlle ...[truncated 1374 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the default installation command with a reviewed, explicitly pinned release.
2. Bind the installed artifact to an immutable integrity digest, not only a mutable package version.
3. Publish and verify a signed artifact manifest before the plugin is loaded.
4. Include the exact executable plugin source and dependency lockfile in the security-review scope.
5. Require integrity verification for the npm fallback, or remove that fallback from production guidance.
6. Pin all transitive dependencies through a lockfile and enforce frozen or reproducible installation.
7. Verify at runtime that the plugin can contact only the documented HTTPS origins and /api/v1/ route catalog.
8. Test credential non-disclosure, route blocking, approval gates, filesystem denial, private-data minimization, and payment limits against the exact pinned artifact.
9. Update the packaged scan evidence so that its reviewed component list matches the files actually shipped.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · evals/evals.json (reported line 29)May include surrounding context.

json

"wait for explicit approval"
      ],
      "must_not_include": [
        "post without approval",
        "batch write"
      ]
    },

Static analysis

No suspicious patterns detected.