AIsa Twitter API Command Center

PassAudited by ClawScan on May 4, 2026.

Overview

This skill is coherent for Twitter/X research and approved posting, but it requires trusting AIsa with an API key/OAuth relay and any post content or attachments you choose to send.

Install this only if you trust AIsa as a Twitter/X relay. Before posting, review the exact content, media files, reply or quote target, and authorized account. Do not attach private files unless you intend to send them to AIsa and potentially publish them.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

If authorized, the skill can publish through the connected Twitter/X account via AIsa.

Why it was flagged

The skill uses an AIsa API key and OAuth authorization to act through a Twitter/X account.

Skill content

Required secret: `AISA_API_KEY` ... After the user completes authorization, publish using the authorized account.

Recommendation

Only use this with an AIsa key and Twitter/X account you trust the relay to access, and revoke OAuth access if you no longer need it.

Note

ASI02: Tool Misuse and Exploitation

What this means

A mistaken or premature invocation could publish unwanted public content.

Why it was flagged

The documented CLI can create public Twitter/X posts; this is purpose-aligned but high-impact if invoked with the wrong content.

Skill content

python3 scripts/twitter_oauth_client.py post --text "Hello from Twitter OAuth" ... Try `post` first when the user intent is to publish content.

Recommendation

Confirm the final post text, media, reply/quote target, and account before allowing the post command to run.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Any attached media or post content you approve may be transmitted to AIsa before reaching Twitter/X.

Why it was flagged

Local attachments and post content are sent to AIsa's relay endpoint for upload and publishing.

Skill content

The Python client reads the local file and sends it to the relay backend as `multipart/form-data` ... Posting, OAuth, and approved media uploads are relay-based and go to `api.aisa.one`.

Recommendation

Attach only files you intend to upload publicly or send to AIsa, and avoid passing arbitrary local paths.