ClawAudit verdict
x-twitter-scraper
x-scraper
X/Twitter data via Xquik REST API using XQUIK_API_KEY; security declarations confirm no X login secrets collected, allowed hosts limited to xquik.com, audit logging enabled.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. ClawAudit flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Findings (5)
Pipe to python — executes piped content as Python code
SKILL.md · prose · downgraded · | Python
Dynamic import() — loads module at runtime
references/webhooks.md · code · import (
"
Python urllib.request — network access
references/python-examples.md · code · urllib.request
Accesses sensitive environment variables
references/webhooks.md · code · process.env.XQUIK_WEBHOOK_SECRET
References tunneling service
references/webhooks.md · code · ngrok
Permissions & capabilities
Requires 1 environment variable. (1 sensitive: XQUIK_API_KEY).
Is this flag fair?
Thanks — recorded.