安全决策报告
tweet-monitor-pro
The skill is a non-functional commercial tweet scraping tool whose primary capability — all fetch operations — delegates to a non-existent external Python script via undeclared shell execution, making it operationally broken but not actively malicious.
为什么得出这个结论
1/4 个维度触发 阻止
声明与实际能力
发现 3 项声明之外的能力或越权行为。
复核
隐藏执行与外联
提取到 2 个一般风险产物，需要结合上下文判断。
通过
攻击链与高危发现
没有形成明确的恶意路径。
复核
依赖与供应链卫生
没有完整依赖信息，供应链判断需要保留弹性。
风险分是怎么被拉高的
Undeclared shell execution +15
index.js uses execSync to invoke a Python script, but SKILL.md never mentions subprocess or shell usage
Hardcoded non-existent external script reference +10
All fetch functions call /root/.openclaw/workspace/skills/x-tweet-fetcher/scripts/fetch_tweet.py which is not bundled and does not exist
Doc deception on execution model +5
SKILL.md claims 'zero-dependency basics' and describes HTTP fetching, but code delegates to external Python subprocess
最关键的证据
中危 文档欺骗
Undeclared shell execution via execSync
SKILL.md describes the skill as using 'FxTwitter public endpoint' with zero dependencies, but index.js actually executes a Python script via child_process.execSync. This shell execution is never declared in the documentation.
index.js:98 Declare shell execution in SKILL.md under a Tools/Permissions section. If the intent is to avoid subprocess, refactor to use a Node.js HTTP library (e.g., fetch/axios) directly.
中危 供应链
Hardcoded reference to non-existent external script
All three main fetch functions (fetchTweet, fetchTimeline, monitorUser) call execSync with a hardcoded absolute path /root/.openclaw/workspace/skills/x-tweet-fetcher/scripts/fetch_tweet.py. This script is not bundled with the skill, does not exist in the file tree, and references a completely different skill directory ('x-tweet-fetcher'). All fetch operations will fail at runtime.
index.js:97 Either bundle the Python script within this skill's directory or remove the dependency entirely. If Python scraping is needed, document it explicitly and include the script.
低危 文档欺骗
False claim of 'zero-dependency'
SKILL.md advertises 'Zero-dependency basics: Fetch single tweets without Camofox', but the implementation depends on an external Python script and a Camofox browser plugin for advanced features. The 'zero-dependency' claim is misleading.
SKILL.md:5 Remove the 'zero-dependency' claim or clarify that a Python dependency is required.
低危 敏感访问
Undeclared environment variable read
index.js reads process.env.QUOTA_DB to determine the quota database path. While the default is a relative path (quotas.json), any operator-configured QUOTA_DB environment variable is not declared in documentation.
index.js:15 Document the QUOTA_DB environment variable in SKILL.md if it is intended to be configurable.
声明能力 vs 实际能力
命令执行 阻止
声明 NONE
→ 推断 WRITE
index.js:98 — execSync(args.join(' ')) 文件系统 阻止
声明 NONE
→ 推断 READ+WRITE
index.js:32 — fs.readFileSync(QUOTA_DB); index.js:37 — fs.writeFileSync(QUOTA_DB) 网络访问 通过
声明 READ
→ 推断 READ
Indirect — fetch delegated to external Python script (unverified) 环境变量 阻止
声明 NONE
→ 推断 READ
index.js:15 — process.env.QUOTA_DB 可疑产物与外联
中危 外部 URL
https://x.com/user/status/123456 README.md:49
中危 外部 URL
https://skillpay.me README.md:92
依赖与供应链
没有结构化依赖告警。
文件构成
6 个文件 · 665 行
JavaScript 1 个文件 · 340 行Markdown 2 个文件 · 281 行JSON 3 个文件 · 44 行
需关注文件 · 3
index.js Undeclared shell execution via execSync · Hardcoded reference to non-existent external script · Undeclared environment variable read
SKILL.md False claim of 'zero-dependency'
README.md https://x.com/user/status/123456 · https://skillpay.me
其他文件 · manifest.json · quotas.json · _meta.json
安全亮点
No credential harvesting or sensitive file access detected
No data exfiltration to external servers observed
No obfuscation techniques (base64, eval, etc.) present
Quota system provides basic usage tracking for transparency
No evidence of reverse shell, C2 communication, or persistence mechanisms