ClawHub
Back to skill

Security audit

FakeX-Till-YouAI

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for X post drafting and publishing, but it asks the agent to handle live X API secrets and automatic public posting without enough storage and safety detail.

Use the half-automatic mode unless you are comfortable giving the agent credentials that can post to your X account. If enabling full automatic mode, configure credentials outside chat when possible, use least-privilege or test-account credentials, confirm where secrets are stored, and review scheduled posts before they publish.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

This line instructs collection or verification of X API credentials, including secrets and tokens, which is a direct credential-handling operation. In the context of an agent skill, requesting and processing those values can expose them through logs, prompts, memory, or downstream scripts, making unauthorized posting or account takeover feasible.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
If the user chooses full automatic, collect or verify:
- X API key
- X API secret
- X access token
- X access token secret

If the user chooses half automatic, skip X API setup.

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

This line continues the instruction to collect an access token secret, which is highly sensitive because possession is sufficient to act on behalf of the user's X account. The danger is heightened by the skill's automation goal and local scripting references, which create realistic paths for secret leakage and abuse beyond simple draft generation.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md
- X API key
- X API secret
- X access token
- X access token secret

If the user chooses half automatic, skip X API setup.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README explicitly promotes automatic publishing to X with user-supplied API credentials but does not warn about accidental posting, unwanted account actions, rate limits, policy violations, or reputation damage if drafts are incorrect or scheduled improperly. In this skill context, the omission is more significant because the tool is designed to generate and publish user-facing content, so mistakes directly affect a real external account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill directs collection of X API credentials and persistent configuration handling without any explicit warning about security, storage location sensitivity, or safer alternatives. In a posting automation skill, this increases the chance that secrets are entered into chat, written to insecure local files, or retained longer than necessary, exposing the user's social media account to takeover if the environment is compromised.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly instructs the agent to collect the user's X API key, secret, access token, and access token secret for full-automatic posting. Collecting live credentials inside an agent workflow materially expands the attack surface: secrets may be logged, surfaced in transcripts, mishandled by tooling, or reused by other components, enabling unauthorized posting and account compromise.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill specifies persistent storage in ~/.x-post-orchestrator/config.json for posting mode, credential presence/state, and stable posting preferences, while elsewhere requiring credential collection for automation. A dotfile JSON path strongly suggests local plaintext or weakly protected storage patterns; if credentials or secret-adjacent metadata are stored there, any local compromise, backup leak, or permissive file permissions could expose the posting account.

Content

No source excerpt is available for this finding.