AIsa Twitter API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:14 AM UTC
• Version: 1.0.6

Overview

This Twitter/X skill is mostly purpose-aligned, but its posting client prints the raw AISA API key in command output, which can leak credentials into logs or agent transcripts.

Review before installing. Use this only if you trust the AIsa relay with Twitter/X API requests, post content, selected media files, and your AISA_API_KEY. Do not run the OAuth posting client with a real key until the raw key is removed or masked from command output; rotate the key if it has already appeared in logs or transcripts.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/twitter_oauth_client.py:337

Finding

AISA API Key Disclosed in Command Output and Result Objects

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

A substantial mismatch between the advertised read/research/watchlist functionality and code that is reportedly focused mainly on authorization and posting creates a trust and consent problem. Users or orchestrators may invoke the skill expecting passive research behavior, while the actual implementation may drive account authorization or external posting flows, which raises the risk of unintended writes to a third-party service.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A substantial mismatch between the advertised read/research/watchlist functionality and code that is reportedly focused mainly on authorization and posting creates a trust and consent problem. Users or orchestrators may invoke the skill expecting passive research behavior, while the actual implementation may drive account authorization or external posting flows, which raises the risk of unintended writes to a third-party service.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The post/status flows include the full AIsa API key in printed JSON output, even though the key is only needed for authenticating requests and is not required for normal user-visible results. Printing secrets to stdout risks credential disclosure through terminal history, logs, CI output, agent transcripts, or downstream tooling, which could let anyone with access to that output use the key against the remote AIsa API.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The authorization command prints the full AIsa API key alongside the authorization URL and raw response. Because authorization is likely to be run interactively and captured in shell history, logs, notebook output, or agent traces, this unnecessarily exposes a bearer credential that can be reused by others.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares access to an API key and explicitly relies on outbound network access to a relay, but it does not define an explicit tool scope such as permissions or allowed-tools. That omission can cause overly broad execution in hosts that depend on manifest scoping, increasing the chance of unintended environment-variable access or network use beyond what the user expects.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/post_twitter.md (reported line 86)May include surrounding context.

md

## Guardrails

- Do not ask the user for their Twitter password.
- Do not use cookie-based login or proxy-based login unless the user explicitly asks for legacy behavior.
- Do not default to `--open-browser`; return the authorization link unless the user explicitly wants local browser launch.
- Do not invent remote URLs for attachments; always use the provided local workspace file path with `--media-file`.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/twitter_client.py (reported line 35)May include surrounding context.

python

DEFAULT_TIMEOUT = 30
DEFAULT_BASE_URL = "https://api.aisa.one/apis/v1"
DEFAULT_CHROME_USER_AGENT = (
    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
    "AppleWebKit/537.36 (KHTML, like Gecko) "

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/twitter_oauth_client.py (reported line 29)May include surrounding context.

python

DEFAULT_TIMEOUT = 30
DEFAULT_BASE_URL = "https://api.aisa.one/apis/v1"
DEFAULT_CHROME_USER_AGENT = (
    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
    "AppleWebKit/537.36 (KHTML, like Gecko) "

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The authorize command reads the sensitive AISA_API_KEY from the environment and sends it in an Authorization header and JSON payload to the remote service, but there is no explicit user disclosure that a credential is being used and transmitted. The output also includes the raw API key value, increasing the need for a clear warning around sensitive credential handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The post command sends tweet text, media IDs, and uploaded local media files to the remote AIsa service via HTTP requests, but the execution path only prints results after transmission and does not present a prior disclosure or confirmation. Although posting is the script's purpose, the code also uploads local files and forwards content to a third-party endpoint, which merits an explicit warning to the user before execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.