ClawHub
Back to skill

Security audit

⁠X Reader⁠

Security checks across malware telemetry and agentic risk

Overview

This X/Twitter reader skill is purpose-aligned and disclosed, but it requires local X session cookies to work.

Install only if you are comfortable letting this skill use X auth_token and ct0 cookies. Prefer a secondary X account, keep the session file private, and delete ~/.config/xreader/session.json if you no longer want the skill to reuse that account session.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/xreader.mjs:54