X Twitter

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears to be a straightforward, read-only X/Twitter API client that uses a user-provided bearer token for searching tweets, fetching tweet/article details, and retrieving trends.

This looks safe for its stated purpose. Before installing, make sure you are comfortable providing an X/Twitter API bearer token, understand that API calls may consume rate limits or paid quota, and avoid using sensitive private text as search queries.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

The skill can use your X API token to make read-oriented API requests, which may consume rate limits or paid API quota.

Why it was flagged

The skill requires an X/Twitter bearer token. This credential use is clearly disclosed and directly aligned with accessing the X API.

Skill content

metadata: { "openclaw": { "emoji": "𝕏", "requires": { "bins": ["python3"] }, "env": ["X_BEARER_TOKEN"], "primaryEnv": "X_BEARER_TOKEN" } }

Recommendation

Use a token scoped appropriately for read-only API access when possible, and monitor X API usage or billing limits.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

Queries and requested tweet IDs or trend locations are sent to X's API as part of normal operation.

Why it was flagged

The script makes external API requests using user-provided search parameters. This is expected for a Twitter/X search client and is not account-mutating.

Skill content

response = requests.get(url, headers=self.headers, params=params)

Recommendation

Avoid entering sensitive private information as search queries unless you are comfortable sending it to X.

NoteMedium Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If requests is not already installed, the user may need to install it separately, and should use a trusted package source.

Why it was flagged

The scripts depend on the external Python requests package, but the artifact set has no install spec or pinned dependency file. There is no automatic install behavior shown.

Skill content

import requests

Recommendation

Install dependencies from a trusted Python package index and prefer pinned versions in controlled environments.