Security audit
TweetClaw
Security checks across malware telemetry and agentic risk
Overview
TweetClaw is a disclosed X/Twitter automation plugin with meaningful account, posting, private-data, paid-read, and monitoring powers, but its artifacts align those powers with the stated purpose and include user-approval and scoping controls.
Install only if you want an agent to perform X/Twitter workflows through Xquik. Review every approval prompt carefully, especially posts, deletes, DMs, follows, profile edits, extractions, monitors, paid reads, and private data requests. Keep API and MPP keys in sensitive plugin config, leave polling disabled if you do not want background monitor notifications, and use the Xquik dashboard for account connection and billing changes.
SkillSpector
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
61/61 vendors flagged this plugin as clean.
Static analysis
No suspicious patterns detected.