X Twitter Automataion (Search + Post)

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:05 AM UTC
• Version: 1.0.4

Overview

This Twitter/X skill mostly matches its stated search and posting purpose, but it exposes the configured AIsa API key in normal command output and has ambiguous posting instructions that could affect public posts.

Install only if you trust AIsa with Twitter/X searches, uploaded media, OAuth posting, and the configured API key. Until the key-output behavior is fixed, avoid running or sharing status, authorize, or post command output in logs or transcripts, and review each post request carefully before publishing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares required environment variables and relies extensively on outbound network access, but it does not declare corresponding permissions in a clear permission model. This can cause reviewers or runtime policy systems to underestimate the skill's ability to read secrets and transmit data to a third-party API, increasing the risk of unintended secret exposure or overbroad execution.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The skill's agent instructions say to default to `--type quote` for publishing, which conflicts with the earlier documented behavior that normal standalone posts should not send quote/reply relationship fields. This can cause the agent to transform ordinary user posts into quote-post attempts, potentially appending or requiring external tweet context and creating unintended public interactions on the user's account.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The module and CLI are presented as read-only, but the shared request layer explicitly supports POST requests. In an agent-skill context, this mismatch can mislead reviewers, orchestrators, or users into granting trust or permissions to a component that can be extended or invoked for write operations later.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The generic _request method accepts POST and prepares JSON bodies, despite the skill being described as read-only. This creates a capability gap between the advertised behavior and actual code behavior, which is risky in a security-sensitive agent environment because hidden write capability can be abused by future code changes or unexpected invocation paths.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The status command prints the configured AISA API key directly to stdout, exposing a bearer credential to any caller, logs, terminal history, or orchestration layer capturing command output. For a Twitter search/post helper, revealing the relay credential is unnecessary and materially increases the risk of unauthorized relay use or downstream account actions.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Authorization and publishing flows include the raw AISA API key in returned JSON, causing the secret to be echoed during the most common operational paths. Because these commands are likely invoked by agents, wrappers, or users that log outputs, the credential can be broadly exposed and then reused to call the relay API for posting or authorization actions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill does not clearly warn users that tweet text, attached media, and metadata are transmitted to external relay/back-end services and may be published publicly on X/Twitter. In a posting skill, this omission increases the risk of users unintentionally sending sensitive or private content off-platform and making it publicly visible.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: For POST requests, the code duplicates the API key into the request body via aisa_api_key in addition to the Authorization header. Putting secrets into request bodies increases the chance of leakage through server logs, proxies, error telemetry, analytics, or downstream processing systems, especially when users are not clearly informed this will occur.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The code emits a sensitive API key in plain, user-visible command output without masking or warning. This is dangerous because CLI output is commonly captured by shells, CI logs, agent transcripts, and support tooling, turning a transient secret into a persistent exposure.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The status command discloses sensitive runtime configuration, including the API key, in a diagnostic response with no warning or access control. In the skill context, status is a likely low-friction command, so exposing secrets here makes accidental disclosure especially easy.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: Echoing the API key in plain-language authorization/post output creates an explicit data exposure path independent of transport security. The Twitter skill context makes this more dangerous because the credential can enable unauthorized use of the relay tied to social account actions, creating both abuse and reputational risk.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.