安全决策报告
x-tweet-fetcher
Skill fetches tweets and Chinese platform content as documented, but SKILL.md omits several significant capabilities: shell execution via subprocess (SSH/SCP, router command-queue), undeclared filesystem writes to home directory, and credential reading from OpenClaw's auth-profiles.json.
最直接的威胁证据
为什么得出这个结论
2/4 个维度触发 阻止
声明与实际能力
发现 3 项声明之外的能力或越权行为。
阻止
隐藏执行与外联
提取到 3 个高危 IOC 或外联信号。
通过
攻击链与高危发现
没有形成明确的恶意路径。
通过
依赖与供应链卫生
依赖结构存在，但暂未看到明显高危告警。
风险分是怎么被拉高的
Undeclared shell execution +15
SKILL.md does not declare subprocess usage in sogou_wechat.py (SSH/SCP), paper_recommend.py, to_obsidian.py, or fetch_china.py router queue pattern
Undeclared credential access +5
x-profile-analyzer.py reads OpenClaw's ~/.openclaw/agents/main/agent/auth-profiles.json for API keys — not declared in SKILL.md
Undeclared filesystem writes +5
Writes to ~/.tweet-growth/, ~/.x-tweet-fetcher/, ~/.cache/ without declaration in SKILL.md
Undeclared optional dependencies +5
SKILL.md claims 'zero dependencies' for basic mode but sogou_wechat.py imports 'requests' and common.py imports 'duckduckgo_search'
Hardcoded root paths +5
Default router paths hardcoded to /root/router-agent/* assume root access
最关键的证据
中危 文档欺骗
Shell execution not declared in SKILL.md
SKILL.md describes a tweet-fetcher but never mentions subprocess/shell execution. Four scripts use subprocess: sogou_wechat.py (SSH/SCP), paper_recommend.py (python3), to_obsidian.py (python3), and fetch_china.py (router cmd-queue). This is the primary doc-to-code mismatch.
sogou_wechat.py:167 Add 'shell:WRITE' to capability declarations in SKILL.md. Document SSH/router proxy features explicitly.
中危 凭证窃取
Reads OpenClaw agent auth-profiles.json for API keys
x-profile-analyzer.py silently reads ~/.openclaw/agents/main/agent/auth-profiles.json to load MiniMax API keys. This accesses another AI agent's stored credentials without user awareness or declaration in SKILL.md.
scripts/x-profile-analyzer.py:40 Declare credential access in SKILL.md. Document which files are read and why. Consider prompting for API keys instead of silently reading from other agent files.
中危 文档欺骗
SKILL.md claims 'zero dependencies' but requests library is imported
SKILL.md states 'Basic: Python 3.7+, no external packages' but sogou_wechat.py uses `import requests` and common.py conditionally uses duckduckgo_search. These are not pip-installable stdlib modules.
scripts/sogou_wechat.py:28 Update SKILL.md to list actual dependencies per feature: requests for sogou_wechat, duckduckgo_search for search_web(), playwright for browser backend.
低危 权限提升
Undeclared filesystem writes to home directory
Multiple scripts write cache and data files to ~/.tweet-growth/, ~/.x-tweet-fetcher/, and ~/.cache/ without declaring filesystem:WRITE in SKILL.md.
scripts/growth_config.py:11 Declare filesystem:WRITE and list all written paths in SKILL.md.
低危 权限提升
Hardcoded root-level default paths
Default router command-queue paths are hardcoded to /root/router-agent/* which assumes root privileges and a specific deployment setup. While overrideable via env vars, the defaults leak an expectation of root access.
scripts/sogou_wechat.py:38 Use non-root default paths or document the root requirement explicitly.
低危 文档欺骗
curl|sh pattern in README.md for Nitter installation
README.md line 185 instructs users to run `curl https://nim-lang.org/choosenim/init.sh -sSf | sh` for Nim installation as part of the Nitter self-hosting guide. While in documentation only (not executed by skill code), this is a well-known risky pattern that should be replaced with safer installation instructions.
README.md:185 Replace curl|sh pattern with direct package manager installation (e.g., `apt install nim` or download official binary).
声明能力 vs 实际能力
网络访问 通过
声明 READ
→ 推断 READ
SKILL.md: FxTwitter API, Nitter, Camofox, Sogou 命令执行 阻止
声明 NONE
→ 推断 WRITE
sogou_wechat.py:167-171 (ssh/scp subprocess), paper_recommend.py:199 (python3 subprocess), to_obsidian.py:837 (subprocess.run), fetch_china.py:1285-1306 (router cmd-queue) 文件系统 阻止
声明 NONE
→ 推断 WRITE
growth_config.py:11-13 (~/.tweet-growth), tweet_growth_cli.py:27, fetch_tweet.py:1625 (~/.x-tweet-fetcher), version_check.py:50 (~/.cache) 环境变量 阻止
声明 NONE
→ 推断 READ
Multiple scripts read MINIMAX_API_KEY, OPENAI_API_KEY, NITTER_URL, GITHUB_TOKEN, SOGOU_SSH_HOST, ROUTER_CMD_QUEUE 技能调用 通过
声明 NONE
→ 推断 NONE
No skill_invoke calls found 剪贴板 通过
声明 NONE
→ 推断 NONE
Not used 浏览器 通过
声明 NONE
→ 推断 READ
playwright_client.py, camofox_client.py — browser automation used but declared as Camofox setup 数据库 通过
声明 NONE
→ 推断 NONE
Not used 可疑产物与外联
严重 危险命令
curl https://nim-lang.org/choosenim/init.sh -sSf | sh README.md:185
高危 IP 地址
120.0.0.0 scripts/fetch_china.py:903
高危 IP 地址
124.0.0.0 scripts/playwright_client.py:95
中危 外部 URL
https://img.shields.io/badge/License-MIT-yellow.svg README.md:7
中危 外部 URL
https://img.shields.io/badge/OpenClaw-Skill-blue.svg README.md:8
中危 外部 URL
https://img.shields.io/badge/Python-3.7+-green.svg README.md:9
中危 外部 URL
https://www.python.org README.md:9
中危 外部 URL
https://img.shields.io/github/stars/ythx-101/x-tweet-fetcher?style=social README.md:10
中危 外部 URL
https://x.com/elonmusk/status/123456789 README.md:100
中危 外部 URL
http://127.0.0.1:8788 README.md:107
中危 外部 URL
https://x.com/user/article/123 README.md:132
中危 外部 URL
https://mp.weixin.qq.com/s/... README.md:135
依赖与供应链
| 包名 | 版本 | 来源 | 漏洞 | 备注 |
|---|---|---|---|---|
| requests | unpinned | pip | 否 | Imported by sogou_wechat.py but not declared in SKILL.md |
| duckduckgo-search | unpinned | pip | 否 | Conditionally imported by common.py search_web() |
| playwright | unpinned | pip | 否 | Used by playwright_client.py for browser backend |
文件构成
26 个文件 · 11781 行
Python 20 个文件 · 11027 行Markdown 3 个文件 · 729 行Other 2 个文件 · 22 行Ignore 1 个文件 · 3 行
需关注文件 · 12
scripts/fetch_tweet.py https://api.fxtwitter.com/ · https://pbs.twimg.com/media/ · https://x.com/i/lists/123456789 · https://twitter.com/i/lists/123456789 · https://x.com/i/article/2011779830157557760 · https://x.com/i/article/ · https://x.com/i/article/ID
scripts/fetch_china.py 120.0.0.0 · https://weibo.com/UID/PostID · https://edith.xiaohongshu.com/api/sns/web/v1/feed · https://edith.xiaohongshu.com/api/sns/web/v1/search/notes · https://www.xiaohongshu.com/explore/67b8e3f5000000000b00d8e2 · https://www.xiaohongshu.com/discovery/item/67b8e3f5000000000b00d8e2 · https://www.xiaohongshu.com/explore/
scripts/to_obsidian.py https://x.com/yanhua1010/status/xxx · https://pbs\.twimg\.com/media/[^ · https://pbs\.twimg\.com/media/([A-Za-z0-9_\-
scripts/paper_recommend.py https://doi.org/10.48550/arXiv. · https://openalex.org/ · https://doi.org/
scripts/nitter_client.py https://pbs.twimg.com/
scripts/playwright_client.py 124.0.0.0
scripts/paper_to_obsidian.py https://ar5iv.labs.arxiv.org/html/2401.02385 · https://ar5iv.labs.arxiv.org · http://export.arxiv.org/api/query?id_list=
scripts/tweet_growth.py https://api.fxtwitter.com/i/status/
scripts/arxiv_author_finder.py https://arxiv.org/abs/2603.10165 · https://arxiv.org/abs/ · https://arxiv.org/abs/1706.03762
scripts/x-profile-analyzer.py Reads OpenClaw agent auth-profiles.json for API keys · https://api.minimax.io/anthropic/v1/messages · https://www.minimaxi.com
scripts/common.py http://www.w3.org/2005/Atom · http://arxiv.org/schemas/atom · https://(?:twitter\.com|x\.com · http://schema.org/Organization · https://search.brave.com/search?q=
scripts/sogou_wechat.py SKILL.md claims 'zero dependencies' but requests library is imported · Hardcoded root-level default paths · https://weixin.sogou.com/weixin?type=2&query= · https://weixin.sogou.com
安全亮点
No base64-encoded payloads or obfuscated code found
No credential exfiltration or data发送到 external servers beyond documented API calls
No reverse shell, C2 communication, or persistent backdoor mechanisms
No direct IP network requests to suspicious destinations
SSH/SCP commands use shlex.quote() for proper shell escaping (sogou_wechat.py)
Router path validation checks for path traversal ('..') before writing
API keys are used for their intended purpose (AI analysis, GitHub API) not exfiltrated
No supply_chain typosquatting or malicious dependency patterns detected