AIsa Twitter Post Engage

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:53 AM UTC
• Version: 1.0.3

Overview

The skill’s Twitter/X relay purpose is mostly coherent, but it exposes the AIsa API key in normal command output and should be reviewed before installation.

Install only if you trust the AIsa relay and are comfortable granting it Twitter/X posting and engagement authority. Do not use a valuable AISA_API_KEY with this version unless the key is removed from all command output; rotate any key that may have appeared in logs or agent transcripts.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/twitter_oauth_client.py:342

Finding

AISA API Key Exposed in CLI Output and Redundantly Transmitted in Request Bodies

Content

View full analysis

Remediation

View remediation

``` 3. Remove the redundant body field from the engagement client as well, subject to relay API compatibility. 4. If the relay contract currently requires the body field: - Change the server contract to support header-only authentication. - Mark the body field as sensitive in application, proxy, tracing, and error-reporting systems. - Apply structured redaction before logging request or response objects. - Never include the body credential in client-visible results. 5. Add automated regression tests that invoke `authorize` and `post` with a sentinel key and assert that the sentinel never appears in: - Standard output or standard error. - Returned command objects. - Error messages. - Serialized diagnostics. - Recorded request bodies when header-only authentication is enabled. 6. Rotate any API keys that may already have been exposed through command output, agent transcripts, CI logs, or telemetry. Remove retained copies from accessible logs and artifacts where feasible. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code is clearly a Twitter/X read API client. Its methods and CLI commands support searching profiles and tweets, reading trends, retrieving tweet/user/list/community/space information, and checking follow relationships. However, the declared description explicitly includes 'approved engagement actions' and says it should be used for 'posting, likes, follows, or related workflows.' No such write/action capabilities are implemented in this code chunk. The primary purpose is narrower than declared: research and read access only, not engagement actions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code substantially matches part of the description around approved engagement actions via AIsa relay, specifically likes, unlikes, follows, unfollows, and listing recent tweets. However, the declared description also claims support for searching profiles, tweets, and trends, plus posting workflows. In this code chunk, there is no implementation for trend retrieval, tweet search, or posting content. User lookup is limited to resolving a target account for engagement, and tweet access is limited to fetching a user's recent tweets. Because the description includes material capabilities not actually implemented here, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description claims a skill for searching Twitter/X content (profiles, tweets, trends) and performing approved engagement actions such as posting, likes, and follows through the AIsa relay. The supplied code only provides three commands: authorize, post, and status. Its concrete network interactions are limited to /twitter/auth_twitter and /twitter/post_twitter on the AIsa API. The posting implementation includes text splitting to fit Twitter limits, quote/reply chaining, and media file upload, but there is no code for search, profile lookup, tweet lookup, trend retrieval, likes, follows, or other research workflows. Because the declared purpose materially overstates and mischaracterizes the implemented capabilities, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Post results are serialized to stdout with the raw API key embedded, so any observer of logs or tool output can recover a valid credential. In an agent skill context, tool outputs may be surfaced to users or upstream systems, which makes this especially dangerous because a posting workflow can unintentionally become a credential exfiltration channel.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script includes the raw AIsa API key in stdout output for post/status/authorization results, which can leak credentials into terminal history, CI logs, chat transcripts, or agent tool output. Because this skill is specifically intended for relay-based social media actions, exposing the bearer credential undermines the trust boundary and allows anyone who obtains the output to invoke the relay API as the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The authorization flow prints the API key back to stdout alongside the authorization URL and raw response, creating a direct secret exposure path. Authorization commands are especially likely to be run interactively or captured in logs, so leaking the bearer token here can immediately enable unauthorized use of the relay service.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill declares access to an API key and explicitly states that all calls go to a remote relay, but it does not define any explicit tool scope such as allowed tools or permissions. This increases the chance that an agent runtime will grant broader-than-necessary network or environment access, weakening containment for a skill that can perform external actions on behalf of a user.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The skill explicitly routes all activity through an external service and requires an API key, which means user prompts, targets, metadata, and potentially post content are transmitted off-platform. In a skill that can perform social-media actions, this raises meaningful data handling and trust-boundary risks, especially if users assume actions are local or first-party.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

export AISA_API_KEY="your-key"

text

All network calls go to `https://api.aisa.one/apis/v1/...`.

## Capabilities

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/engage_twitter.md (reported line 27)May include surrounding context.

md

When the user asks to like, unlike, follow, or unfollow on X/Twitter:

1. Do not ask the user to manually paste tweet links or IDs.
2. If the user first asked to query tweets, keep the returned `tweets[]` structure in the current agent context.
3. Map ordinal follow-up requests to remembered tweet or author context.
4. If multiple user candidates match a natural-language name, stop and ask the user to confirm the account.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/post_twitter.md (reported line 86)May include surrounding context.

md

When the user asks to like, unlike, follow, or unfollow on X/Twitter:

1. Do not ask the user to manually paste tweet links or IDs.
2. If the user first asked to query tweets, keep the returned `tweets[]` structure in the current agent context.
3. Map ordinal follow-up requests to remembered tweet or author context.
4. If multiple user candidates match a natural-language name, stop and ask the user to confirm the account.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file documents only OAuth-based posting flows: authorize, post, reply, quote, and media upload through the relay. It does not describe support for searching profiles, tweets, trends, or approved engagement actions like likes/follows that the manifest says the skill covers, creating a semantic mismatch between claimed scope and documented behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module docstring at L003-L011 and CLI description at L218 describe the tool as providing only read APIs, and the comments segment the commands as read/search/detail operations. However, the shared _request method explicitly supports POST bodies at L67-L69, enabling write-style operations if additional endpoints are added or invoked, which exceeds the documented read-only behavior in this file.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstring says 'Twitter/X read APIs' and 'Read operations use GET' at L004-L006, and the CLI description repeats 'read APIs' at L218. Yet the core request function contains explicit POST handling and JSON body serialization at L67-L69, contradicting the stated read-only intent rather than merely omitting detail.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The client performs state-changing actions against X/Twitter (like, unlike, follow, unfollow) immediately after argument parsing and user resolution, with no explicit confirmation, approval gate, or secondary consent step in this script. In an agent skill context, that is risky because a prompt-injected or mistaken upstream instruction could cause unintended social-account actions on behalf of the user, making the absence of friction or confirmation materially more dangerous than in a purely local manual CLI.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/twitter_client.py (reported line 35)May include surrounding context.

python

DEFAULT_TIMEOUT = 30
DEFAULT_BASE_URL = "https://api.aisa.one/apis/v1"
DEFAULT_CHROME_USER_AGENT = (
    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
    "AppleWebKit/537.36 (KHTML, like Gecko) "

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/twitter_oauth_client.py (reported line 29)May include surrounding context.

python

DEFAULT_TIMEOUT = 30
DEFAULT_BASE_URL = "https://api.aisa.one/apis/v1"
DEFAULT_CHROME_USER_AGENT = (
    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
    "AppleWebKit/537.36 (KHTML, like Gecko) "

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The post flow sends tweet content and optional media to the AIsa API endpoint, and includes the bearer/API key in request handling, but the code does not present a clear user warning about transmitting this data to an external service. Although the tool's purpose is posting, there is no explicit disclosure at the point of action beyond generic help text.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The manifest mentions Twitter/X research, posting, likes, follows, and related workflows through the relay, but this implementation also performs unrestricted local filesystem reads for user-supplied paths before transmitting file contents remotely. While media upload can support posting, the manifest does not mention local file access, so the implemented behavior is broader than the described capability.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Line L87 implies cookie-based or proxy-based login may still be available as a legacy path if the user asks for it. But L97 states this workflow does not use passwords, browser cookies, cache sync, or home-directory persistence, which contradicts the earlier instruction about conditional cookie-based behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The inline user-facing message states that browser auto-open is disabled in this release, yet the parser still advertises an --open-browser option and the module imports webbrowser. This creates a documentation/intent inconsistency because the interface suggests a capability that the code explicitly says is unavailable.

Content

No source excerpt is available for this finding.