Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a real X/Twitter automation skill, but it can read/send DMs and publish, delete, follow, like, and repost from a connected account with limited built-in approval guidance.
Install only if you are comfortable giving AgentPMT-controlled workflows access to operate your connected X/Twitter account, including private DMs and public account actions. Use narrow account scopes where possible, require human approval for posts, replies, DMs, follows, reposts, and deletes, and avoid using engagement actions solely to unlock unsolicited replies.
The skill advertises high-impact capabilities such as posting, engaging, following, and sending DMs without a dedicated warning section explaining abuse, privacy, consent, or destructive-action risks. In an agent setting, that omission can cause unsafe autonomous use, especially where actions affect public accounts or private communications.
The workflow explicitly tells the agent to first like or repost posts so it becomes eligible to reply, which operationalizes a staged bypass of the platform's intended reply restriction. This is dangerous because it converts a guardrail into a procedural hurdle and enables automated unsolicited engagement and outreach at scale.
delete_post is documented as a normal action without clearly stating that deletion may be irreversible or operationally harmful if triggered by mistake or prompt injection. For an autonomous agent controlling a social account, destructive operations need explicit caution and confirmation guidance.
The skill exposes lookup_dms and send_dm capabilities without a clear privacy and consent warning, despite handling private communications and potentially sensitive personal data. In an agent context, this increases the chance of unauthorized reading, disclosure, or messaging of private conversations.
The notes section reinforces the same pattern by instructing the agent to engage with a post first in order to reply, creating a progressive permission-escalation workflow. In this context, the skill is not merely documenting a restriction; it is teaching the agent how to circumvent it using intermediate actions.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/x-twitter-automation
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/x-twitter-automation
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase
The manifest describes composing, publishing, searching, engaging, and DMing on X/Twitter, but this schema also exposes extensive X List management operations: creating, deleting, updating Lists, following/unfollowing Lists, pinning/unpinning Lists, inspecting List contents, and changing List membership. Those administrative List capabilities go beyond the concrete behaviors claimed in the manifest description and are not mentioned there.
Destructive actions such as deleting posts, DMs, or Lists are documented without explicit warnings about irreversibility or confirmation expectations. In an agentic context, this increases the risk of accidental or prompt-induced destructive operations that can cause permanent content loss and account impact.
The skill exposes DM read and send capabilities without privacy warnings, despite granting access to potentially sensitive private communications and enabling outbound messaging. In an agent workflow, this can lead to unintended collection, disclosure, or abuse of private messages if users are not clearly warned about the sensitivity of these actions.
The manifest frames the skill around post/reply/search/engagement/DM automation, but the schema also includes separate media lifecycle operations such as uploading media from file IDs or public URLs, setting alt text and video download permissions, and attaching/removing subtitle tracks. These are meaningful capabilities not reflected in the manifest's stated scope.
Beyond publishing and recent post search, the schema supports broad read operations including user lookup/search, follower/following inspection, liked-post inspection, community discovery, news lookup, and trends lookup. While some monitoring is mentioned in the manifest, these discovery and account-inspection capabilities are broader than the specific description provided.
No suspicious patterns detected.