AIsa Twitter API (Search + Post)

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:36 AM UTC
• Version: 1.0.1

Overview

This appears to be a legitimate Twitter/X tool, but it needs review because it can publish publicly and exposes the AIsa API key in normal command output.

Install only if you trust AIsa with Twitter/X queries, selected media, and delegated posting. Treat the tool's command output as sensitive because this version can print the raw AISA_API_KEY. Before any post, verify the final text, attachments, and whether it is standalone, quoted, replied, or threaded; leave TWITTER_RELAY_BASE_URL unset unless you intentionally trust that alternate relay.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (32)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares required environment variables and demonstrates extensive outbound network access, but does not declare corresponding permissions in a clear, enforceable way. This creates a transparency and governance gap: an agent may read secrets from the environment and transmit user queries or account-related data to a third-party API without an explicit permission boundary.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The instruction to default to `--type quote` conflicts with nearby rules that say standalone posts should not include relationship fields and that quote-posting requires an explicit quoted tweet URL. In practice, this can cause the agent to alter user intent, produce malformed posting behavior, or accidentally attach relationship semantics to content that should have been a normal post, increasing the risk of unintended disclosure or posting mistakes to an external platform.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The module documentation describes the client as read-only, but the generic request helper already supports POST and injects credentials into POST bodies. This mismatch is dangerous because downstream agents, reviewers, or users may trust the tool as non-mutating and permit it in contexts where write-capable tooling should be blocked or more tightly supervised.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The CLI help text advertises only read APIs while the underlying helper supports POST operations. In an agent skill context, misleading operator-facing text can cause unsafe approval decisions and allow hidden state-changing behavior to bypass intended review controls.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The status command prints the raw AISA API key to stdout, which can be captured by logs, calling agents, shell history tooling, or other local observers. Exposing a bearer credential is more severe than ordinary debug output because anyone who obtains it can reuse the relay capability and potentially authorize or post on behalf of the user through the upstream service.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The authorize/post flow includes the raw AISA API key in normal JSON output, causing credential disclosure during routine successful operation rather than only in exceptional logging. In an agent skill context, command stdout is often surfaced to orchestration layers, transcripts, or users, so this creates an unnecessary secret exfiltration path.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill description does not clearly warn users that their Twitter queries, targets, and potentially account-linked posting actions are sent to a third-party service (AIsa). In a social-listening and posting context, this is materially important because prompts may contain sensitive business monitoring terms, brand strategies, or account actions that users may assume stay local to the agent.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The example trigger phrase is broad enough that normal conversational text like 'Help me post this to Twitter' may activate a high-impact action skill without sufficiently clear boundaries. In a posting skill, overbroad invocation increases the chance of accidental transmission of user-supplied content to Twitter/X or launching an authorization/posting flow when the user intended only discussion or drafting.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill does not clearly warn that tweet text, attached media, and local workspace files will be sent to external services, including a relay backend and Twitter/X. Because this skill handles publishing and file upload, missing disclosure can cause users to unknowingly transmit sensitive content outside the local environment.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The client reads a secret from the environment and then, for any POST request, duplicates that API key into the JSON request body in addition to the Authorization header. Placing credentials in bodies increases exposure through server-side logging, debugging middleware, request capture tools, and downstream processing, making accidental secret disclosure significantly more likely.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: This finding is substantively true because the script echoes a sensitive API key in both normal command output and status-style responses without warning or minimization. Silent disclosure of secrets is dangerous in CLI and agent environments where output is commonly stored, forwarded, or inspected beyond the immediate caller.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $AISA_API_KEY"

# Get user profile about (account country, verification, username changes)
curl "https://api.aisa.one/apis/v1/twitter/user_about?userName=elonmusk" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Batch get user info by IDs

• Confidence: 93% confidence
• Finding: https://api.aisa.one/

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $AISA_API_KEY"

# Batch get user info by IDs
curl "https://api.aisa.one/apis/v1/twitter/user/batch_info_by_ids?userIds=44196397,123456" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get user's latest tweets

• Confidence: 93% confidence
• Finding: https://api.aisa.one/

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $AISA_API_KEY"

# Get user's latest tweets
curl "https://api.aisa.one/apis/v1/twitter/user/last_tweets?userName=elonmusk" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get user mentions

• Confidence: 93% confidence
• Finding: https://api.aisa.one/

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $AISA_API_KEY"

# Get user mentions
curl "https://api.aisa.one/apis/v1/twitter/user/mentions?userName=elonmusk" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get user followers

• Confidence: 93% confidence
• Finding: https://api.aisa.one/

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $AISA_API_KEY"

# Get user followers
curl "https://api.aisa.one/apis/v1/twitter/user/followers?userName=elonmusk" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get user followings

• Confidence: 93% confidence
• Finding: https://api.aisa.one/

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $AISA_API_KEY"

# Get user followings
curl "https://api.aisa.one/apis/v1/twitter/user/followings?userName=elonmusk" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get user verified followers (requires user_id, not userName)

• Confidence: 93% confidence
• Finding: https://api.aisa.one/

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $AISA_API_KEY"

# Get user verified followers (requires user_id, not userName)
curl "https://api.aisa.one/apis/v1/twitter/user/verifiedFollowers?user_id=44196397" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Check follow relationship between two users

• Confidence: 93% confidence
• Finding: https://api.aisa.one/

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $AISA_API_KEY"

# Check follow relationship between two users
curl "https://api.aisa.one/apis/v1/twitter/user/check_follow_relationship?source_user_name=elonmusk&target_user_name=BillGates" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Search users by keyword

• Confidence: 93% confidence
• Finding: https://api.aisa.one/

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $AISA_API_KEY"

# Search top tweets
curl "https://api.aisa.one/apis/v1/twitter/tweet/advanced_search?query=AI+agents&queryType=Top" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get tweets by IDs (comma-separated)

• Confidence: 94% confidence
• Finding: https://api.aisa.one/

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $AISA_API_KEY"

# Get tweets by IDs (comma-separated)
curl "https://api.aisa.one/apis/v1/twitter/tweets?tweet_ids=1895096451033985024" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get tweet replies

• Confidence: 92% confidence
• Finding: https://api.aisa.one/

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $AISA_API_KEY"

# Get tweet replies
curl "https://api.aisa.one/apis/v1/twitter/tweet/replies?tweetId=1895096451033985024" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get tweet quotes

• Confidence: 92% confidence
• Finding: https://api.aisa.one/

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $AISA_API_KEY"

# Get tweet quotes
curl "https://api.aisa.one/apis/v1/twitter/tweet/quotes?tweetId=1895096451033985024" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get tweet retweeters

• Confidence: 92% confidence
• Finding: https://api.aisa.one/

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $AISA_API_KEY"

# Get tweet retweeters
curl "https://api.aisa.one/apis/v1/twitter/tweet/retweeters?tweetId=1895096451033985024" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get tweet thread context (full conversation thread)

• Confidence: 92% confidence
• Finding: https://api.aisa.one/

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $AISA_API_KEY"

# Get tweet thread context (full conversation thread)
curl "https://api.aisa.one/apis/v1/twitter/tweet/thread_context?tweetId=1895096451033985024" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get article by tweet ID

• Confidence: 93% confidence
• Finding: https://api.aisa.one/

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.