twitter

SAFE max severity MEDIUMSkillSpector Safe 0 registry clawhub.ai last scanned 2026-02-07 1 scan

Verdict safe, but 2 findings (2 medium), mainly data exfiltration, social engineering. Most recent scan 2026-02-07.

This Twitter integration skill presents MEDIUM severity security risks primarily due to its incomplete implementation. The skill solicits sensitive Twitter API credentials (API key, secret, access token) through environment variable configuration but provides zero implementation files to actually use these credentials securely. This creates a credential exposure risk where users may configure sensitive tokens without any functional code to protect them. Additionally, the skill engages in social engineering by claiming comprehensive Twitter functionality (posting, timeline reading, follower management, analytics, scheduling) while containing no actual implementation - this false advertising could mislead users into trusting and installing a non-functional skill. The skill also lacks important optional metadata (license, compatibility, allowed-tools) and declares external binary dependencies (curl, jq) without validation. While no active malicious code was detected (since no code exists), the combination of credential solicitation without implementation and deceptive functionality claims represents a moderate security concern. This appears to be either an abandoned template or an incomplete skill that should not be distributed in its current state.
Scanner's overall assessment (LLM analyzer)

Findings2

Critical0

High0

Medium2

Low0

Analyzersstatic llm meta

Second scanner: NVIDIA SkillSpector

VerdictSafe 0

Score0 / 100

Issues0

Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Twitter/X platform integration. Post tweets, read timeline, manage followers, and analyze engagement.

Package: 1 file, 673 B
SKILL.md: 52 words, 4 sections
Code: None. Instructions only.
Requires: bins: curl jq

SKILL.md covers: Twitter 🐦 · Setup · Features · Usage Examples

Findings

MEDIUM Missing Implementation Creates Credential Exposure Risk Data Exfiltrationllm

The skill declares Twitter API credentials (TWITTER_API_KEY, TWITTER_API_SECRET, TWITTER_ACCESS_TOKEN) in setup instructions but provides no script files to implement the functionality. This creates a security risk where users may expose credentials in their environment without any actual secure implementation to use them. The skill cannot function as described, yet encourages credential configuration.

SKILL.md

```bash
export TWITTER_API_KEY="your_api_key"
export TWITTER_API_SECRET="your_api_secret"
export TWITTER_ACCESS_TOKEN="your_access_token"
```
No corresponding Python/Bash scripts found to securely handle these credentials.

Remediation: 1. Implement actual script files (Python/Bash) that securely handle Twitter API credentials. 2. Use secure credential storage mechanisms instead of environment variables (e.g., encrypted credential stores). 3. Add input validation and secure API call implementations. 4. Include error handling for credential failures. 5. Document secure credential management practices.

MEDIUM Deceptive Functionality Claims Without Implementation Social Engineeringllm

The skill claims to provide comprehensive Twitter integration features (post tweets, read timeline, search, manage followers, analytics, schedule posts) but contains zero implementation files. This is social engineering through false advertising - users may trust and install the skill believing it provides these capabilities, potentially exposing credentials or attempting to use non-existent functionality.

SKILL.md

Claimed features:
- Post tweets
- Read timeline
- Search tweets
- Manage followers
- Analytics
- Schedule posts

Actual implementation: No script files found.

Remediation: 1. Remove the skill entirely or clearly mark as 'template/placeholder'. 2. If keeping as template, add prominent warnings that implementation is required. 3. Implement all claimed features before distribution. 4. Add 'status: incomplete' or 'status: template' to YAML manifest. 5. Do not encourage credential configuration until implementation exists.

What is in the package

File	Kind	Size
`SKILL.md`	doc	673 B

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Sources

Repository: https://clawhub.ai/skills/twitter
Raw scan result: twitter-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/clawhub-ai-twitter.svg)
Request a re-scan