Security audit

twitter-autopilot-aisa

Security checks for vulnerabilities and agentic risk

Overview

This Twitter/X automation skill is mostly purpose-aligned, but it exposes the configured API key in normal output and allows credentials and media to be sent to arbitrary HTTP or HTTPS relay URLs.

Review this skill carefully before installing. It can perform real Twitter/X account actions and can publish text or selected media through a relay. Do not run status, authorize, or post commands with a sensitive AISA_API_KEY unless the key-output issue is fixed or you are comfortable with that key appearing in logs/transcripts. Avoid setting TWITTER_RELAY_BASE_URL to custom or HTTP endpoints unless you fully trust the destination.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/twitter_oauth_client.py:337
Finding: API Key Disclosed Through Standard Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/twitter_oauth_client.py:44
Finding: Arbitrary and Plaintext Relay Destinations Can Receive Credentials and Local Media
Content: View full analysis
str: value = base_url.strip().rstrip("/") if not value: raise RelayConfigError("TWITTER_RELAY_BASE_URL is required.") parsed = urllib.parse.urlparse(value) if parsed.scheme not in {"http", "https"} or not parsed.netloc: raise RelayConfigError("TWITTER_RELAY_BASE_URL must be a valid http(s) URL.") return value def load_config(args: argparse.Namespace) -> Dict[str, Any]: base_url = normalize_base_url( get_env("TWITTER_RELAY_BASE_URL", DEFAULT_BASE_URL) ) aisa_api_key = getattr(args, "aisa_api_key", None) or get_env("AISA_API_KEY") timeout = getattr(args, "timeout", None) or int(get_env("TWITTER_RELAY_TIMEOUT", str(DEFAULT_TIMEOUT))) if not aisa_api_key: raise RelayConfigError("AISA_API_KEY is required.") return { "base_url": base_url, "aisa_api_key": aisa_api_key, "timeout": timeout, } ``` From `scripts/twitter_oauth_client.py:78-104`: ```python def build_auth_headers(aisa_api_key: str, extra_headers: Optional[Dict[str, str]] = None) -> Dict[str, str]: headers = { "Authorization": f"Bearer {aisa_api_key}", "User-Ag ...[truncated 6760 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (25)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description overstates the skill’s capabilities. The supplied code clearly supports Twitter/X search, monitoring/discovery, and trend tracking, which align with parts of the description. However, the description also claims publish/engagement capabilities through the AISA relay—specifically posting, replying, liking, and following workflows. Those capabilities are not actually implemented in this code chunk: there are no methods or CLI commands for create-tweet, reply, like, retweet, follow, or other write operations. The module docstring explicitly describes 'read APIs,' and all exposed commands are read-only. While the low-level _request helper can send POST requests, that is just infrastructure and does not constitute implemented write capabilities. Therefore this is a material description/behavior mismatch due to undeclared absence of claimed write actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The declared description significantly overstates the implemented functionality. The code supports a narrow subset of the claimed Twitter workflows: user resolution, listing recent tweets, like/unlike, and follow/unfollow. While this partially matches the declared mention of like/follow workflows, major claimed capabilities are absent: there is no post publishing, no reply action, no trend tracking, and no ongoing monitoring/social listening. The only 'search' behavior present is user lookup and fetching a user's tweets, not general Twitter search or trend discovery. Additionally, the code includes a status command that reveals relay base URL, API key, timeout, and supported endpoints, which is not reflected in the description. Because the primary purpose in code is a local engagement relay client rather than a broad Twitter search/monitor/publish skill, this is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description overstates the skill’s capabilities. This code only supports three CLI actions: authorize, post, and status. Posting includes tweet text splitting, quote/reply threading, media file upload, and opening an OAuth authorization URL in a browser. There is no functionality for searching Twitter data, monitoring accounts, tracking trends, liking posts, following accounts, or reading/listening workflows. The primary implemented purpose is authorization and publishing via the relay, which is only a subset of the declared behavior.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.
md
## When NOT to Use - Do not use this skill for browser-cookie extraction, passwords, Keychain access, or other local sensitive credential access. - Prefer a different skill when the user request is outside this skill's domain. ## Capabilities

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Printing the raw API key to standard output is direct secret disclosure. In an agent skill context, stdout is commonly captured by orchestrators, logs, notebook history, and user-visible responses, so the leak can propagate well beyond the local terminal and enable credential theft.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The configured API key is emitted in plain text, which defeats its role as an authentication secret. Because this skill can trigger state-changing actions such as like, unlike, follow, and unfollow through a relay, disclosure of the key can allow unauthorized use of those capabilities and potential abuse of the linked account or relay service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README explicitly advertises account-affecting actions such as liking, following, replying, and posting on Twitter/X, but it does not provide a clear warning that these operations can perform real actions on a user's account. In an autonomous-agent context, this increases the risk of unintended social actions, reputational harm, or policy-violating automation because an operator may treat the skill as informational rather than action-capable.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill declares access to environment variables and implicitly relies on networked clients, but it does not declare any explicit tool scope such as permissions or allowed-tools. That makes the skill's operational boundary ambiguous and increases the chance it is invoked with broader capabilities than intended, especially for a write-capable social-media integration.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The invocation description is very broad and could match many generic social-media requests, causing the skill to be selected too often. In a write-capable skill, overbroad activation materially raises the risk of unintended posting, following, liking, or surveillance-style account monitoring in contexts where a narrower or read-only tool should have been used.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The 'When to Use' section is broad and lacks enough negative triggers or decision rules for safe activation. Because this skill supports live account actions, ambiguous activation guidance can lead to accidental use for sensitive social-media tasks, including engagement actions that modify a real account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises posting and engagement features but does not prominently warn that these actions can modify a live Twitter/X account and create irreversible external effects. In practice, that omission increases the risk of accidental posts, follows, likes, or replies being executed under a user's connected identity.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
md
- Read Twitter X profiles, timelines, mentions, followers, trends, and search results via AISA APIs. - Support posting, replying, quoting, liking, unliking, following, and unfollowing through the shipped OAuth relay clients. - Keep auth API-key based for read paths and OAuth based for write paths without asking for passwords or browser cookies. ## Quick Start

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Advertising the file as read-only while retaining generic POST capability creates a security transparency problem. In an agent skill context, this increases the chance that orchestration logic or human reviewers permit the tool in read-only workflows even though the underlying code can be extended or repurposed for state-changing requests.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module documentation states the client is read-only, but the shared request helper includes POST support and injects credentials into POST bodies. That mismatch can mislead reviewers, users, or higher-level agents into trusting the module as non-mutating while it is technically capable of write operations and secret transmission.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The client sends the API key both in the Authorization header and again inside every POST body via aisa_api_key. Duplicating secrets in request payloads increases exposure through downstream application logs, tracing systems, proxies, error reports, and third-party processing, especially in an agent platform that may relay requests through additional infrastructure.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The status command returns the configured AISA API key directly in user-facing JSON output. Any caller who can invoke this diagnostic command can recover the credential and then reuse it to access the relay or perform unauthorized Twitter engagement actions outside the intended workflow.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The help text presents status as a harmless configuration/diagnostic command, but the implementation exposes a live secret. This mismatch increases the chance that operators, agents, or users will run the command casually and unintentionally disclose the credential into logs, chat transcripts, or other observable output.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/twitter_client.py (reported line 36)May include surrounding context.
python
DEFAULT_TIMEOUT = 30 DEFAULT_BASE_URL = "https://api.aisa.one/apis/v1/twitter" DEFAULT_CHROME_USER_AGENT = ( "Mozilla/5.0 (Windows NT 10.0; Win64; x64) " "AppleWebKit/537.36 (KHTML, like Gecko) "

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/twitter_oauth_client.py (reported line 27)May include surrounding context.
python
DEFAULT_TIMEOUT = 30 DEFAULT_BASE_URL = "https://api.aisa.one/apis/v1/twitter" DEFAULT_CHROME_USER_AGENT = ( "Mozilla/5.0 (Windows NT 10.0; Win64; x64) " "AppleWebKit/537.36 (KHTML, like Gecko) "

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The client performs HTTP POST requests to an external relay and sends authorization headers, tweet content, and optionally uploaded media files. Although network posting is part of the tool's purpose, the code lacks any explicit user-facing disclosure that local text and media are sent to api.aisa.one, which is especially relevant for OAuth and media upload flows.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The authorize and publish flows include the full API key in JSON output, causing the credential to be echoed during normal operation. Since these commands are likely to be run interactively or from automation, the secret can leak into logs or transcripts and be reused by anyone who obtains it.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script exposes the complete API key in user-facing output without masking or warning, which materially increases the chance of accidental disclosure. Because the key is a bearer token, any leak can grant immediate access to relay-backed actions such as posting or authorization workflows.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The status command prints the full AISA API key to stdout, which can be captured by shell history, terminal logs, CI logs, screen recordings, or other local telemetry. Exposing a bearer credential in routine diagnostic output creates an unnecessary secret disclosure path that can directly enable unauthorized use of the Twitter relay service.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest sets "language": "en", which is a natural-language locale constraint. Under the policy, locale restrictions should either offer user choice/opt-in or be clearly justified as region-specific; this file provides neither.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: main() sets the parser description to 'Twitter/X read APIs', which tells operators this program is limited to read behavior. The shared request path nevertheless supports POST requests with authenticated JSON bodies, so the operational intent described in the CLI does not match the implementation capability.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.