AIsa Twitter API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:01 AM UTC
• Version: 1.0.5

Overview

This Twitter/X skill is mostly coherent, but it needs review because it exposes the relay API key in command output and can upload any readable image or video path supplied to it.

Review before installing. Use it only if you are comfortable routing Twitter/X queries, draft post text, OAuth authorization, and selected media through api.aisa.one. Do not run it in shared terminals, CI, or logged agent sessions until the API key is redacted from output, and only pass media files you explicitly intend to upload. Rotate AISA_API_KEY if it has already appeared in logs or transcripts.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/twitter_oauth_client.py:342

Finding

Plaintext AISA API Key Disclosed in CLI Output

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/twitter_oauth_client.py:377

Finding

AISA API Key Is Redundantly Transmitted in Request Bodies

Content

View full analysis

Dict[str, Any]: payload: Dict[str, Any] = { "aisa_api_key": config["aisa_api_key"], } if content: payload["content"] = content if post_type: payload["type"] = post_type if media_ids: payload["media_ids"] = media_ids if parent_tweet_id: parent_key = "in_reply_to_tweet_id" if post_type == "reply" else "quote_tweet_id" payload[parent_key] = parent_tweet_id endpoint = f"{config['base_url']}/twitter/post_twitter" if media_files: return send_multipart_request( endpoint, payload, media_files, timeout=config["timeout"], aisa_api_key=config["aisa_api_key"], ) return send_json_request( endpoint, payload, timeout=config["timeout"], aisa_api_key=config["aisa_api_key"], ) ``` Authorization requests do the same: ```python def command_authorize(args: argparse.Namespace) -> None: config = load_config(args) payload = {"aisa_api_key": config["aisa_api_key"]} result = send_json_request( f"{config['base_url']}/twitter/auth_twitter", payload, timeout=config["timeout"], aisa_api_key=config["aisa_api_key"], ) ``` The same credential is already placed in the HTTP authorization header: ```python def build_auth_headers(aisa_api_key: str, extra_headers: Optional[Dict[str, str]] = None) -> Dict[ ...[truncated 1755 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/twitter_oauth_client.py:419

Finding

Unrestricted Local File Paths Can Be Read and Uploaded to the Relay

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

If the advertised read/research capabilities are absent while the actual implementation is concentrated on authorization and posting, the skill is materially misrepresented. In security-sensitive agent workflows, this can induce users or orchestration systems to invoke a write-capable external-posting skill under the assumption that it is primarily read-only research tooling, raising the chance of unintended external actions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

If the advertised read/research capabilities are absent while the actual implementation is concentrated on authorization and posting, the skill is materially misrepresented. In security-sensitive agent workflows, this can induce users or orchestration systems to invoke a write-capable external-posting skill under the assumption that it is primarily read-only research tooling, raising the chance of unintended external actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The API key is emitted in cleartext without masking or warning in normal command output. In the context of a Twitter posting skill, that secret is a sensitive capability token; exposing it makes downstream compromise more dangerous because an observer can post or act via the AIsa relay without needing the user's password.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The authorize command prints the bearer token alongside the authorization URL and raw response. Authorization flows are especially likely to be copied into tickets, chats, or logs, so including the key materially increases the risk of credential leakage and unauthorized use of the relay-backed Twitter capability.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares required environment access and relay-based network use, but does not explicitly scope or constrain those capabilities with a permissions or allowed-tools declaration. In an agent ecosystem, missing tool-scope metadata can cause the runtime or reviewer to underestimate what the skill can access, increasing the risk of overbroad secret exposure or unintended outbound requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document explains that local workspace media and user-provided post content are sent to a relay backend and then to Twitter/X, but it does not prominently warn users at the point of use that invoking the skill transmits potentially sensitive local files and text off-box to external services. In an agent setting, unclear disclosure can lead to unintended exfiltration of local media or sensitive draft content, especially when users may assume attachments remain local unless explicitly told otherwise.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/post_twitter.md (reported line 86)May include surrounding context.

md

## Guardrails

- Do not ask the user for their Twitter password.
- Do not use cookie-based login or proxy-based login unless the user explicitly asks for legacy behavior.
- Do not default to `--open-browser`; return the authorization link unless the user explicitly wants local browser launch.
- Do not invent remote URLs for attachments; always use the provided local workspace file path with `--media-file`.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module docstring and CLI description repeatedly describe this client as providing only "Twitter/X read APIs". However, the shared _request helper explicitly implements POST request support and JSON request bodies, which enables write-capable API calls if endpoints are added or invoked through this client, making the documented scope broader in code than advertised.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The module docstring says "Twitter/X read APIs for autonomous agents" and specifically states that "Read operations use GET," while the central request routine contains logic to send POST requests with serialized JSON bodies. That is an active contradiction between the documented intent and the implemented transport behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/twitter_client.py (reported line 35)May include surrounding context.

python

DEFAULT_TIMEOUT = 30
DEFAULT_BASE_URL = "https://api.aisa.one/apis/v1"
DEFAULT_CHROME_USER_AGENT = (
    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
    "AppleWebKit/537.36 (KHTML, like Gecko) "

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/twitter_oauth_client.py (reported line 29)May include surrounding context.

python

DEFAULT_TIMEOUT = 30
DEFAULT_BASE_URL = "https://api.aisa.one/apis/v1"
DEFAULT_CHROME_USER_AGENT = (
    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
    "AppleWebKit/537.36 (KHTML, like Gecko) "

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script includes the raw AIsa API key in user-visible JSON output from posting/status flows. Exposing a bearer token in stdout is dangerous because terminals, shell history, CI logs, chat transcripts, or calling agents may capture it, allowing anyone with the key to reuse the Twitter-posting capability through the relay API.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module docstring states that authorize supports --callback-url <url>, but build_parser() defines only --open-browser for that subcommand and the authorization command never handles a callback URL. This is a direct contradiction between documentation and code behavior, not merely an omitted detail.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The CLI interface and module docstring present local authorization behavior and import webbrowser, suggesting browser-assisted authorization, but the actual code explicitly refuses to perform the browser action. This is an intent-level mismatch in exposed capability: the skill advertises a local browser-open flow that is not actually implemented.

Content

No source excerpt is available for this finding.