Security audit

x-twitter-browser

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed X/Twitter automation tool, but it needs Review because it stores reusable login cookies and has unsafe browser handling around real account actions.

Review carefully before installing. Use it only with an X account you are comfortable automating, keep ~/.openclaw/auth/x-twitter/cookies.json private, revoke the X session if the file may have been exposed, and manually confirm every public action. Prefer passing tweet IDs or verified x.com URLs only, and run browser automation in a constrained environment because the packaged browser disables sandbox protections.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/repost_post.py:35
Finding: Attacker-controlled URLs are opened in an authenticated browser with Chromium sandboxing disabled
Content: View full analysis
None: target = tweet_url if "/status/" in tweet_url else f"https://x.com/i/status/{tweet_id}" page.goto(target, wait_until="domcontentloaded", timeout=timeout_ms) page.wait_for_timeout(3000) ``` `scripts/repost_post.py:51-54`: ```python def open_tweet_and_quote(page, tweet_url: str, tweet_id: str, text: str, timeout_ms: int) -> None: target = tweet_url if "/status/" in tweet_url else f"https://x.com/i/status/{tweet_id}" page.goto(target, wait_until="domcontentloaded", timeout=timeout_ms) page.wait_for_timeout(3000) ``` `scripts/like_post.py:31-34`: ```python def open_tweet_and_like(page, tweet_url: str, tweet_id: str, undo: bool, timeout_ms: int) -> None: target = tweet_url if "/status/" in tweet_url else f"https://x.com/i/status/{tweet_id}" page.goto(target, wait_until="domcontentloaded", timeout=timeout_ms) page.wait_for_timeout(3000) ``` `scripts/bookmark_post.py:31-34`: ```python def open_tweet_and_bookmark(page, tweet_url: str, tweet_id: str, undo: bool, timeout_ms: int) -> None: target = tweet_url if "/status/" in tweet_url else f"h ...[truncated 2929 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/setup.sh:12
Finding: Setup installs mutable unpinned Playwright and browser dependencies
Content: View full analysis
Remediation: View remediation
--hash=sha256: ``` 2. Install dependencies with hash enforcement: ```bash python3 -m pip install --user --require-hashes -r requirements.txt ``` 3. Generate and review a lock file for every supported platform and Python version. Update it through a controlled dependency-review process rather than resolving the latest release during installation. 4. Use an explicitly configured trusted package index and prevent fallback to unexpected indexes. In controlled deployments, mirror reviewed wheels and browser artifacts internally. 5. Pin and verify the corresponding browser revision or container image. Record checksums or cryptographic provenance for downloaded artifacts where the Playwright tooling permits it. 6. Run installation and browser automation under a dedicated unprivileged account or isolated container with only the filesystem and network permissions required by the skill. 7. Add automated dependency scanning and scheduled review for Playwright, Chromium, and transitive dependencies. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description claims a broader X/Twitter automation capability set: logging in and performing posting, replying, reposting, liking, and bookmarking. However, this code chunk is narrowly focused on composing and submitting a new post, plus verifying an existing session. There is no implementation for replying, reposting, liking, or bookmarking in the supplied code. Also, while the description emphasizes logging in, this chunk does not implement an interactive login flow; it relies on helper functions to launch a browser and verify session state. This is a material description-to-behavior mismatch because the declared skill capabilities significantly exceed what the code shown actually does.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'file_read' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 95% confidence
Finding: The skill explicitly persists authenticated X/Twitter session cookies in a shared long-lived location under ~/.openclaw/auth/x-twitter/cookies.json for reuse across runs and skills. If that file is read by another local process, exfiltrated, or copied to another machine, an attacker may gain unauthorized access to the user’s X account without needing credentials or 2FA.
Content: Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.
md
## Operational requirements - Before the first action, check if session exists; if not, run the two-phase login flow (see "Session management" above) - Run `--verify-only` before any write operation - Confirm the action and content before executing - Do not commit cookies to the repo (`~/.openclaw/auth/`) - Call `scripts/*.py` directly

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script performs a live reply action immediately after session verification and text entry, with no explicit confirmation gate, dry-run default, or strong user warning before clicking the post button. In a skill designed to control a real authenticated X/Twitter session, this increases the risk of unintended public posting if the caller supplies the wrong tweet ID, reply text, or invokes the script in error.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The browser context is hard-coded to locale="en-US", and the injected script further forces navigator.languages to ['en-US', 'en']. This imposes an English/US locale on all users without offering a choice or documenting a justified region-specific requirement.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.