AIsa Twitter API

• Outcome: Review
• Latest audit: Jul 11, 2026 · 8:38 PM UTC
• Version: 1.0.5

Overview

The skill’s Twitter/X relay workflow is mostly disclosed, but its posting client exposes the raw AISA API key in command output.

Review before installing. The skill is transparent about using an AIsa relay for Twitter/X reads, OAuth, posting, and media upload, but the current posting client should be fixed to remove or redact AISA_API_KEY from all printed JSON and error output before use in any logged or agent-mediated environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill explicitly requires an API key and makes outbound network requests to a relay service, but it does not declare corresponding permissions despite those capabilities being central to its operation. This creates a transparency and policy-enforcement gap: users or hosting platforms may not realize the skill can access secrets from the environment and transmit data externally, increasing the risk of unintended secret exposure or unauthorized data egress.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code includes the raw AISA API key in normal and error JSON output from publish_chunks, exposing a bearer credential to terminals, logs, calling agents, and any downstream consumers of stdout. In an agent skill context, stdout is often captured automatically, making this especially dangerous because the secret can be replayed to the remote API for unauthorized actions.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The authorize command prints the raw API key alongside the authorization URL and raw server response, directly leaking a reusable bearer token. Because this script is designed for OAuth flows and likely to be used interactively or through automation, the key may be exposed in shell history captures, CI logs, chat transcripts, or agent tool outputs.

Ssd 3

High

• Confidence: 99% confidence
• Finding: Echoing the API key back in ordinary command output and failure paths creates a reliable secret-exfiltration channel through natural-language or JSON responses. In the context of an agent skill, this is more dangerous than a normal CLI because model/tool orchestration layers frequently store and relay outputs beyond the local machine.

Ssd 3

High

• Confidence: 99% confidence
• Finding: Printing the API key during authorization exposes the same bearer secret at the exact point users are likely to share or inspect output for troubleshooting. Since the script also includes the authorization URL and raw response, the exposure is highly visible and increases the chance of accidental disclosure to logs, screenshots, and support channels.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.