Security audit

AIsa Twitter Research Engage

Security checks for vulnerabilities and agentic risk

Overview

This Twitter/X skill mostly does what it claims, but it exposes the required AIsa API key in normal command output.

Install only if you trust AIsa with your API key, tweet text, media files, and live Twitter/X actions. Avoid running status, authorize, or post commands in shared terminals, CI logs, or agent transcripts until the API key is removed or redacted from outputs; rotate the key if it has already been exposed. Confirm the target account and action before posting, liking, following, or unfollowing.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The skill instructs the agent to default all publishing to `--type quote`, which conflicts with earlier guidance that normal standalone posts should not include relationship fields and that quote mode should only be used when the user explicitly wants to quote another tweet. This can cause the agent to alter user intent, produce malformed or incomplete quote posts, and potentially attach unintended external tweet relationships during posting.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The module is documented and exposed through the CLI as a read-only Twitter client, but the shared request helper also supports POST and automatically injects the API key into POST request bodies. This creates a capability/documentation mismatch that can mislead downstream callers or future maintainers into enabling state-changing operations, while unnecessarily broadening the secret exposure surface.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The status command returns the configured AISA API key in cleartext JSON output, which is a direct secret disclosure. Any caller, log collector, terminal history, or downstream tool that invokes status can capture and reuse the credential to access the relay/API outside the intended workflow.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: The status command prints the raw AISA API key, which is a secret unrelated to the user's need to inspect Twitter relay status. CLI output is commonly captured in terminals, logs, shell history wrappers, CI transcripts, or agent tool traces, so exposing the bearer token creates a straightforward credential disclosure path that can enable unauthorized use of the relay/API.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The authorize/post flows include the raw AISA API key in JSON output shown to the caller. Because these commands are intended for Twitter OAuth and posting, echoing back the bearer credential unnecessarily broadens exposure and can leak the token to users, orchestrators, chat transcripts, or logging systems, enabling replay and unauthorized API actions.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: publish_chunks returns structured success and failure objects containing the raw AISA API key, so any caller or logger receiving posting results also receives reusable credentials. In an agent skill context this is more dangerous because tool outputs are often persisted, forwarded, or visible to upstream systems beyond the immediate operator.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The description is broad enough to match many generic social-media requests, including research, monitoring, and engagement, which increases the chance the skill is invoked outside a tightly intended context. Because the skill also supports OAuth-gated posting, over-broad routing could escalate a simple research request into a workflow with access to write-capable social media actions.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The 'When to use' triggers are expansive and include broad categories like research, monitoring, posting, and engagement without concrete boundaries or exclusions. In a user-invocable skill with network access and OAuth-linked posting, vague activation criteria increase the risk of accidental invocation, unnecessary data access, or unintended progression toward write operations.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This skill performs real account-changing actions on X/Twitter such as liking, unliking, following, and unfollowing, but the introductory description does not clearly warn that these are live actions on the user's account. In an agent workflow, that omission increases the chance of users authorizing unintended social actions or misunderstanding the consequences of a request.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The attachment flow states that local workspace media and post content are sent to an external relay backend and then to Twitter/X, but the skill does not prominently warn users about this data transmission before use. That omission creates a privacy and consent risk, especially when users may assume local attachments remain within the agent environment rather than being uploaded to third-party services.

Missing User Warnings

High

Confidence: 99% confidence
Finding: This is a true positive because the command exposes a live credential without masking, warning, or access control. In an agent skill context, stdout is often surfaced to users, other tools, traces, and logs, so plaintext key disclosure materially increases the chance of credential theft and unauthorized API use.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The status command exposes the API key with no masking or warning, which violates least disclosure for a diagnostic command. Even if intentional for convenience, unguarded display of a bearer secret materially increases the chance of accidental leakage through screenshots, terminal recordings, or agent logs.

Ssd 3

High

Confidence: 99% confidence
Finding: The configured API key is intentionally included in the response object and then emitted as JSON, so the leak is deterministic rather than incidental. Given this skill performs OAuth-gated posting and engagement actions, exposing the key can enable unauthorized likes, follows, unlikes, unfollows, or broader abuse of the backing service.

Static analysis

No suspicious patterns detected.