Security audit
Security checks for vulnerabilities and agentic risk
This skill is an X/Twitter account automation tool that mostly matches its purpose, but it under-discloses delete, like, and timeline access and gives no confirmation guard for deleting live account content.
Install only if you are comfortable giving this skill OAuth credentials for a real X/Twitter account. Treat it as able to post, reply, quote, like, delete tweets, and read recent account tweets; require explicit user approval before any delete or public engagement action, and do not rely on the documented scheduling commands unless the implementation is updated.
The manifest says the skill posts tweets, threads, replies, and quote-tweets, but the documented commands also support liking, deleting, and reading timeline data. This mismatch can mislead reviewers and users about the true power of the skill, increasing the chance of unauthorized destructive or privacy-impacting actions being invoked.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `X_API_KEY` — X API key (OAuth 1.0a consumer key)
- `X_API_SECRET` — X API secret
- `X_ACCESS_TOKEN` — Access token
- `X_ACCESS_SECRET` — Access token secret
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `X_API_KEY` — X API key (OAuth 1.0a consumer key)
- `X_API_SECRET` — X API secret
- `X_ACCESS_TOKEN` — Access token
- `X_ACCESS_SECRET` — Access token secret
The skill requires environment-based credentials and instructs execution of a local script, but it does not declare any explicit tool scope such as permissions or allowed-tools. That omission weakens reviewability and policy enforcement because consumers cannot easily see that the skill depends on sensitive env-backed capabilities before use.
The documented command set materially exceeds the stated description, so the manifest understates what the skill can do. Understated capabilities reduce transparency and make it harder for operators to apply informed approval, especially where account-modifying and content-deleting operations are present.
The skill documents a delete command for tweets without any warning, dry-run option, or confirmation guidance. In an agent setting, destructive actions without friction increase the risk of accidental or unauthorized content removal from a live account.
The skill’s declared purpose is posting to X, but it also supports liking tweets, deleting tweets, and reading the user timeline. Those extra capabilities expand the available attack surface and allow state-changing actions beyond the minimum needed for posting, which is dangerous in an agent context because a prompt-injected or misused agent could perform unintended account actions.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if (!queryParams) queryParams = {};
return new Promise(function(resolve, reject) {
const credentials = getCredentials();
const urlObj = new URL('https://api.twitter.com/2' + path);
Object.keys(queryParams).forEach(function(k) {
urlObj.searchParams.append(k, queryParams[k]);
});
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if (!queryParams) queryParams = {};
return new Promise(function(resolve, reject) {
const credentials = getCredentials();
const urlObj = new URL('https://api.twitter.com/2' + path);
Object.keys(queryParams).forEach(function(k) {
urlObj.searchParams.append(k, queryParams[k]);
});
No suspicious patterns detected.