ClawHub
Back to skill

Security audit

auto-test-skill

Security checks for vulnerabilities and agentic risk

Overview

This finance-analysis skill is mostly coherent, but its optional X/Twitter features ask users to handle active session credentials in ways that are broader and less clearly protected than expected.

Install only if you are comfortable with a finance tool making external market/news/social requests and storing local portfolio/watchlist data. Avoid enabling the X/Twitter feature unless you understand that AUTH_TOKEN and CT0 can function like account session credentials; use a low-risk account, protect or delete the .env file, verify the bird CLI source, avoid granting broad disk access where possible, and remove any cron job when no longer needed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill declares no permissions, yet its documented commands and metadata clearly imply shell execution, network access, environment variable use, and local file reads/writes. This mismatch is a real security issue because it hides the skill's true capabilities from the permission model and from users, reducing transparency and undermining least-privilege review.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The README tells users to extract `AUTH_TOKEN` and `CT0` from browser cookies and place them into a local `.env` file, which encourages handling active session credentials outside the browser. These tokens can grant account access if exposed through shell history, backups, logs, screenshots, or accidental commits, and the instructions do not clearly warn users about the sensitivity or scope of these credentials.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documentation tells users to grant Terminal Full Disk Access and manually extract Twitter/X session tokens, then store them in a local .env file, without any warning about the sensitivity of those credentials or the broader privacy and host-security implications. Those steps can expose active session secrets that may be reused to impersonate the user on X, and Full Disk Access materially increases the blast radius if the terminal, shell environment, or related tooling is compromised.

Static analysis

No suspicious patterns detected.