Security audit

AI Topic Scout

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but it handles live X/Twitter session cookies and writes to DingTalk tables in ways that need careful review before use.

Install only in a controlled environment. Use a dedicated low-privilege X/Twitter account, avoid putting auth_token or ct0 in shell commands, clear or disable command history if unavoidable, verify the DingTalk base before any write, replace bundled DingTalk IDs with your own initialized configuration, pin or isolate dependencies, and validate all handles and IDs before executing commands.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Error

Location: SKILL.md:13
Finding: Unpinned Third-Party Packages Are Installed and Executed Globally
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:42
Finding: Twitter Session Credentials Are Exposed Through Command-Line Arguments
Content: View full analysis
", ct0: "" } ``` It then states that the values must be supplied as command-line arguments: ```bash bird user-tweets @{username} -n 5 --plain --auth-token "" --ct0 "" ``` The same practice is reiterated in `references/gotchas.md`: ```bash bird user-tweets @handle -n 5 --plain --auth-token "" --ct0 "" ``` ### Technical Analysis The `auth_token` and `ct0` values are sensitive authenticated-session credentials. Passing them in process arguments exposes them outside the intended tool boundary. Depending on the operating system and execution environment, command-line arguments may be visible through: - Process enumeration tools such as `ps`. - `/proc` process metadata. - Shell history. - CI/CD and scheduled-job logs. - Terminal recording. - Endpoint monitoring and telemetry. - Error reports that capture the executed command. - Parent processes or local users with process-inspection rights. Although authenticated access may be necessary for the selected Twitter CLI, exposing reusable session credentials in the process argument vector is not the minimum safe privilege required for content retrieval. ### Attack Path 1. The user extracts `auth_token` and `ct0` from an authenticated browser session. 2. The Skill constructs a `bird` command containing both secrets in its argument list. 3. A local process, monitoring agent, shell-history mechanism, or job logger records the command. 4. An attacker obtains the recorded token values. 5. The attacker reuses the session credentials to access the victim's X/Twitter account while the s ...[truncated 725 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:94
Finding: Mutable External Identifiers Are Interpolated into Shell Commands Without Validation
Content: View full analysis
","tableId":"", "keyword":"youtube.com/watch?v=" }' --output json # Retrieve the transcript python3 {youtube-watcher-baseDir}/scripts/get_transcript.py "https://www.youtube.com/watch?v=" ``` Twitter usernames are also directly inserted into a command: ```bash bird user-tweets @{username} -n 5 --plain --auth-token "" --ct0 "" ``` ### Technical Analysis The workflow inserts channel identifiers, video IDs, usernames, paths, and credentials into shell command templates. Some of these values originate from mutable DingTalk table records, while others originate from remote tool output. The Twitter username is not quoted. More generally, quoting a generated shell string is not a sufficient security boundary if the command is subsequently interpreted by a shell: command substitutions, malformed quoting, metacharacters, option injection, or unsafe evaluation can still produce unintended behavior. The instructions provide no allowlist validation for: - Twitter handles. - YouTube handles or channel IDs. - Video IDs. - The resolved dependent-Skill directory. - Values inserted into JSON command arguments. If a hostile party can modify a tracked account record, or if malformed upstream output is accepted, the generated command may execute attacker-controlled shell syntax under the Agent user's identity. ### Attack Path 1. An attacker gains the ability to modify a tracked Twitter username or YouTube channel value in the DingTalk table. 2. The attacker in ...[truncated 1326 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/config.json:2
Finding: Packaged Configuration Contains Live DingTalk Resource Identifiers
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs users to extract Twitter/X session cookies (auth_token and ct0) from the browser and then pass them on the command line. These are highly sensitive session credentials: shell history, process listings, logs, screenshots, or copied config snippets can expose them and allow account takeover or misuse of the user's X session. The surrounding workflow increases risk because it normalizes repeated credential handling without strong safeguards or safer alternatives.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This JSON file contains numerous natural-language keys and values in Chinese, such as field names and status labels, but provides no indication that the skill is region-specific or that users can opt into this locale. Under the policy for language/locale handling, forcing a specific language without user choice or justification is a violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation shows passing Twitter authentication secrets directly on the command line via --auth-token and --ct0. On multi-user systems or in CI/server environments, command-line arguments can be exposed through process listings, shell history, job logs, and monitoring tools, which can leak live session credentials and enable account compromise or unauthorized scraping activity.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The entire markdown file is written only in Chinese, including headings, field descriptions, and usage notes, with no indication that users may choose another language or that the file is intended solely for a Chinese-language audience. Under the policy rule for natural-language violations, forcing a specific language without opt-in is reportable when no explicit justification or alternative is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Natural-language policy violations include forcing a specific language without user opt-in. This skill's manifest description and all operational instructions are presented only in Chinese, and there is no indication that the skill is region-specific or that users can choose another language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: The note says returned tweets may include 'Japanese/other-language' ads and should be filtered, singling out language as part of the exclusion guidance. Because the actual stated criterion is whether the tweet author matches the requested handle, mentioning language this way can imply an unnecessary language-based policy without user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file contains user-facing instructions exclusively in Chinese, and there is no indication that the skill is region-specific or that users may choose another language. Under the language/locale policy rule, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.