X Article Extract

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:58 PM UTC
• Version: 1.0.2

Overview

The skill’s core extraction purpose is coherent, but it uses authenticated X session material, third-party scraping, unpinned dependencies, and optional downstream writes without strong permission boundaries.

Review before installing. Use this only if you are comfortable letting it read your xreach/X session file for article scraping, send external t.co targets to Firecrawl when needed, and optionally write extracted material into the content-factory system. Prefer pinned dependency versions, avoid proxy URLs with embedded passwords, and do not use --ingest unless you intend to persist the extracted content.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:21

Finding

Unpinned Third-Party Dependencies Combined with Browser Credential Access

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/extract.py:60

Finding

Authenticated Proxy Credentials Exposed Through Child-Process Arguments

Content

View full analysis

str | None: """获取代理 URL。""" return os.environ.get("HTTPS_PROXY") or os.environ.get("HTTP_PROXY") or None ``` ```python parser.add_argument("--proxy", default="", help="代理地址（默认从环境变量读取）") ``` ### Technical Analysis Proxy URLs commonly embed credentials in the form: ```text https://username:[e-mail]:8443 ``` The implementation appends the complete proxy URL to command-line argument arrays used to launch `curl` and `xreach`. Although use of an argument list prevents shell command injection, it can expose embedded credentials through operating-system process inspection interfaces, process-monitoring software, endpoint telemetry, crash diagnostics, or audit logs. The Playwright path handles proxy credentials as structured configuration and does not create the same child-process command-line exposure in this script. ### Attack Path 1. A user configures `HTTPS_PROXY`, `HTTP_PROXY`, or `--proxy` with embedded authentication credentials. 2. The Skill invokes `curl` or `xreach` and includes the full proxy URL after the `--proxy` argument. 3. While t ...[truncated 1232 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (20)

Tainted flow: 'req' from os.environ.get (line 214, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/extract.py (reported line 223)May include surrounding context.

python

},
            method="POST",
        )
        with urllib.request.urlopen(req, timeout=30) as resp:
            data = json.loads(resp.read().decode())

        if not data.get("success"):

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose says the skill extracts X/Twitter content, but the documented behavior goes beyond that by reading local authenticated session material, injecting cookies into a browser context, calling Firecrawl, and optionally writing extracted content into another system. This mismatch is dangerous because users and orchestrators may approve a low-risk read-only extraction skill without realizing it also touches credentials and performs external writes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README states that external links shared via t.co are extracted using the Firecrawl API, but it does not clearly warn users that URLs and retrieved page content may be transmitted to a third-party service. In a skill designed to process social-media links, this matters because users may pass sensitive or private investigation targets, and silent off-system transmission can cause confidentiality and compliance issues.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run npx clawhub install x-article-extract without pinning a specific version of the package or installer. This creates a supply-chain risk: a future malicious or compromised release of clawhub could execute unexpected code on the user's system during installation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises executable behavior involving shell, network access, and environment-variable use, but it does not declare any explicit tool scope or permissions boundary. This increases the chance that an agent or operator invokes it with broader capabilities than intended, including access to local secrets, authenticated sessions, or outbound network paths.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger conditions are broad enough to match ordinary conversation and direct-link sharing, which can cause the skill to run unexpectedly. In this context, accidental activation is more serious because the skill may initiate network requests, use authenticated X sessions, resolve external links, and potentially ingest data into another system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill supports automatic ingest into a content-factory system, but the documentation does not require an explicit confirmation step or present the write risk clearly. This can lead to unintended persistence, propagation of untrusted content, or contamination of downstream knowledge systems from a simple extraction request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script's user-facing documentation and console output are written in Chinese only, and the tool does not offer any language selection or opt-in mechanism. Under the stated policy, forcing a specific language without user choice is a natural-language locale violation unless clearly justified as region-specific, which is not documented here.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/extract.py (reported line 69)May include surrounding context.

python

"--max-time", "10", tco_url]
        if proxy:
            cmd.extend(["--proxy", proxy])
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=15)
        url = result.stdout.strip()
        return url if url and url != tco_url else None
    except Exception as e:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/extract.py (reported line 101)May include surrounding context.

python

cmd.extend(["--proxy", proxy])

    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        if result.returncode != 0:
            return {"error": f"xreach 失败: {result.stderr.strip()[:200]}"}
        return json.loads(result.stdout)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/extract.py (reported line 183)May include surrounding context.

python

cmd.extend(["--proxy", proxy])

    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        if result.returncode != 0:
            return {"error": f"xreach 失败: {result.stderr.strip()[:200]}"}
        return json.loads(result.stdout)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code reads stored X session credentials from the user's home directory and uses them to authenticate a browser session without any visible warning or confirmation. In a skill context, silent reuse of local credentials is sensitive because it may access account-scoped content or cause users to unknowingly delegate authenticated actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sends resolved external URLs to Firecrawl, a third-party scraping service, with no clear user-facing notice that external content will be transmitted off-platform. This creates privacy and data-handling risk, especially when links may contain sensitive query strings, internal references, or user-specific content.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The code transmits user-derived external URLs and receives scraped page content from a third-party service at api.firecrawl.dev. In this skill's context, that external transmission is more sensitive because users may assume link extraction is local, while the implementation forwards data to an outside processor.

Content

Scanner excerpt · scripts/extract.py (reported line 215)May include surrounding context.

python

try:
        payload = json.dumps({"url": url, "formats": ["markdown"]}).encode()
        req = urllib.request.Request(
            "https://api.firecrawl.dev/v1/scrape",
            data=payload,
            headers={
                "Authorization": f"Bearer {api_key}",

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill metadata describes content extraction, but this section also writes results into a separate content-factory system. That scope expansion is dangerous because users may authorize a read-oriented skill without expecting persistent writes into another local or organizational system.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Calling a local content-factory script to create records gives this extractor a capability that is disproportionate to its stated purpose. In skill ecosystems, excessive capability is risky because it broadens the blast radius of mistakes or abuse beyond simple retrieval into local system modification and downstream propagation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code persists extracted content, author information, and source URLs into an external content-factory system without a clear warning about storage or retention. Hidden persistence is risky because users may expect transient extraction, while the implementation copies potentially sensitive material into another system for later use.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 72% confidence

Finding

This subprocess call launches another local script to create records in an external content-factory system, extending the skill from extraction into side-effectful data mutation. While it does not show shell injection, it introduces an unexpected write capability and data exfiltration/persistence path that could be abused if the operator does not realize ingestion occurs.

Content

Scanner excerpt · scripts/extract.py (reported line 391)May include surrounding context.

python

}

    try:
        proc = subprocess.run(
            ["python3", str(bitable_script), "create",
             "--table", "MaterialInbox",
             "--fields", json.dumps(fields, ensure_ascii=False)],

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

整个技能描述、触发词与使用说明均仅以中文提供，且未说明是否支持其他语言或允许用户按偏好选择语言。根据语言/地区策略，若技能默认强制单一语言而无用户选择，可能构成自然语言层面的政策问题。

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill documents external-page fetching via Firecrawl and t.co resolution but does not warn that URLs and possibly fetched content may be sent to third-party services. This creates a privacy and data-governance risk, especially when users provide sensitive or private links under the assumption that the operation is local.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.