Security audit
Security checks for vulnerabilities and agentic risk
The skill's Twitter research, posting, and engagement purpose is mostly disclosed, but its bundled clients expose the user's AIsa API key in normal command output and allow credentialed relay requests to configurable destinations.
Review before installing. Use only a scoped or disposable AISA_API_KEY, avoid running status/authorize/post commands where output is logged, and do not use a custom TWITTER_RELAY_BASE_URL unless you fully trust it and it uses HTTPS. Treat posting, media upload, likes, follows, and unfollows as live actions on the connected X/Twitter account.
scripts/twitter_oauth_client.py:332API Key Disclosed in Command Output
scripts/twitter_oauth_client.py:46API Key Can Be Sent to an Arbitrary Plaintext Relay
This finding indicates the skill may perform engagement actions such as like/follow relay operations that are not disclosed in the description, while also falsely advertising OAuth posting and trend support. Undeclared account-affecting actions are dangerous because users and platforms may authorize the skill for research purposes without realizing it can mutate social accounts or trigger external actions.
This finding indicates the skill may perform engagement actions such as like/follow relay operations that are not disclosed in the description, while also falsely advertising OAuth posting and trend support. Undeclared account-affecting actions are dangerous because users and platforms may authorize the skill for research purposes without realizing it can mutate social accounts or trigger external actions.
This finding indicates the skill may perform engagement actions such as like/follow relay operations that are not disclosed in the description, while also falsely advertising OAuth posting and trend support. Undeclared account-affecting actions are dangerous because users and platforms may authorize the skill for research purposes without realizing it can mutate social accounts or trigger external actions.
The status command returns the raw configured AISA API key in JSON output. Any user, log collector, transcript, or downstream tool invoking this command can obtain a reusable credential, which can enable unauthorized API use and lateral access beyond the intended Twitter engagement workflow.
Printing the raw AISA API key without masking or warning is a direct secret disclosure vulnerability. In this skill context, the risk is heightened because agent/tool outputs are often surfaced to users, stored in logs, and passed through orchestration layers, making credential exfiltration easy and durable.
The authorize/post flows include the raw AISA API key in command output, and authorize also includes the raw relay response. This exposes a live bearer token during normal operation, making accidental leakage through logs, transcripts, agent tool output, CI captures, or user-visible responses very likely; an attacker who obtains the key can impersonate the client against the relay service.
The skill declares access to an API key and implies networked Python script execution, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authorization ambiguity where an orchestrator may permit broader execution than intended, increasing the chance of unexpected network use or environment-variable access.
The invocation guidance is broad enough to match many common social-media requests, which increases the chance the skill is selected in contexts beyond its safest intended use. Because this skill touches networked APIs and potentially account-affecting workflows, overbroad routing can lead to unnecessary credential use, unintended data sharing, or accidental triggering of higher-risk actions.
The workflow enables real account-changing actions such as like, unlike, follow, and unfollow, but it does not clearly warn that these operations will affect the user's live X/Twitter account. In an agent setting, missing disclosure increases the chance of unintended social actions, especially when users may interpret the skill as research-only or low-risk automation.
The Quick Start instructs users to export an API key but provides no guidance on secure credential handling, such as avoiding shell history leaks, shared terminals, or committing secrets into files. While common in documentation, this omission can still lead to accidental credential exposure and unauthorized use of the relay-backed account actions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
When the user asks to like, unlike, follow, or unfollow on X/Twitter:
1. Do not ask the user for tweet IDs, tweet links, or user IDs.
2. If the user specifies a direct account such as `@elonmusk`, call the `--user` based command.
3. If the user asks for the latest tweet, use `like-latest` or `unlike-latest`.
4. If the user first asked to query tweets, keep the returned `tweets[]` structure in agent context.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
When the user asks to like, unlike, follow, or unfollow on X/Twitter:
1. Do not ask the user for tweet IDs, tweet links, or user IDs.
2. If the user specifies a direct account such as `@elonmusk`, call the `--user` based command.
3. If the user asks for the latest tweet, use `like-latest` or `unlike-latest`.
4. If the user first asked to query tweets, keep the returned `tweets[]` structure in agent context.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
When the user asks to like, unlike, follow, or unfollow on X/Twitter:
1. Do not ask the user for tweet IDs, tweet links, or user IDs.
2. If the user specifies a direct account such as `@elonmusk`, call the `--user` based command.
3. If the user asks for the latest tweet, use `like-latest` or `unlike-latest`.
4. If the user first asked to query tweets, keep the returned `tweets[]` structure in agent context.
The skill describes media upload and publishing flow but does not clearly warn that tweet text and attached files are transmitted to external services, including the relay backend and X/Twitter. Users may unknowingly expose sensitive text, images, or videos to third parties and publish them publicly, which is especially risky in an autonomous agent context where the system may act on user-provided workspace files.
The skill’s agent instructions say to default to --type quote for publishing, which directly contradicts earlier documented behavior that normal standalone posts should not send relationship fields and that quote posting should only occur when the user explicitly wants to quote another tweet. In an externally publishing skill, this contradiction can cause unintended quoting behavior, malformed posts, or accidental inclusion of relationship metadata that changes what gets published to a public third-party platform.
The file-level docs and CLI description repeatedly frame the utility as a read-only Twitter client, yet the implementation contains generic POST capability. In an agent skill context, deceptive or inaccurate capability descriptions are security-relevant because orchestration layers may grant broader trust to a supposedly non-mutating tool, enabling unintended posting or other side effects through future code paths.
The module documentation presents the client as read-only, but the shared request helper supports POST and automatically injects the API key into POST request bodies. This mismatch can cause downstream agents or reviewers to trust the tool as non-mutating while hidden write-capable behavior exists, increasing the risk of unintended state-changing operations and credential exposure if POST endpoints are later added or invoked.
This code sends usernames, tweet IDs, search queries, and other user-supplied parameters to https://api.aisa.one via HTTP requests. Although the module docstring says it uses read APIs and bearer authentication, there is no runtime notice, confirmation, or explicit disclosure that these inputs are transmitted to an external service.
The command is presented as a harmless configuration/status view, but it also discloses the full API key. That mismatch increases the chance operators will run it casually, share its output, or include it in debugging artifacts, causing inadvertent secret leakage.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
DEFAULT_TIMEOUT = 30
DEFAULT_BASE_URL = "https://api.aisa.one/apis/v1/twitter"
DEFAULT_CHROME_USER_AGENT = (
"Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
"AppleWebKit/537.36 (KHTML, like Gecko) "
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
DEFAULT_TIMEOUT = 30
DEFAULT_BASE_URL = "https://api.aisa.one/apis/v1/twitter"
DEFAULT_CHROME_USER_AGENT = (
"Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
"AppleWebKit/537.36 (KHTML, like Gecko) "
The script exposes the API key in user-facing output without masking or warning, which violates safe secret-handling practices and increases the chance of inadvertent credential disclosure. Although this overlaps with the stronger secret-disclosure findings, the lack of masking/warning is itself a real weakness because it normalizes unsafe handling and makes leaks easier in operational environments.
The status command prints the raw AISA API key, unnecessarily disclosing a bearer credential to anyone who can invoke the script, view terminal output, shell history captures, logs, or downstream tooling that records stdout. In this skill’s context, the key is not needed for normal Twitter status reporting, so exposing it creates a direct secret-leak path that can enable unauthorized use of the AIsa Twitter relay and any permissions attached to that account.
No suspicious patterns detected.