T09 · Insecure Skill Coding Practices
Error
- Location
scripts/twitter_oauth_client.py:334- Finding
AIsa API Key Disclosed in Command Output and Redundantly Included in Request Bodies
- Content
View full analysis
- Remediation
View remediation
Security audit
AIsa Twitter Research Engage Relay
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent for Twitter/X research, posting, and engagement, but it exposes the AIsa API key in command output and can upload arbitrary readable local media paths through a third-party relay.
Review before installing. Use this only with an AISA_API_KEY you are willing to expose to the local agent environment, rotate the key if command output may have been logged, and only pass media paths you have explicitly selected for upload. Treat likes, follows, unfollows, replies, quotes, and posts as real public account actions through AIsa.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/twitter_oauth_client.py:416- Finding
Unrestricted Local File Paths Can Be Read and Uploaded as Twitter Media
- Content
View full analysis
list[Dict[str, Any]]: if not paths: return [] media_files: list[Dict[str, Any]] = [] media_kinds: set[str] = set() seen_paths: set[str] = set() for raw_path in paths: resolved_path = os.path.abspath(os.path.expanduser(raw_path)) normalized_path = os.path.normcase(resolved_path) if normalized_path in seen_paths: continue seen_paths.add(normalized_path) if not os.path.exists(resolved_path): raise RelayConfigError(f"Media file does not exist: {raw_path}") if not os.path.isfile(resolved_path): raise RelayConfigError(f"Media path is not a file: {raw_path}") mime_type = mimetypes.guess_type(resolved_path)[0] or "application/octet-stream" media_kind = mime_type.split("/", 1)[0] if media_kind not in {"image", "video"}: raise RelayConfigError( f"Unsupported media type for {raw_path}: {mime_type}. Only image and video files are supported." ) media_kinds.add(media_kind) with open(resolved_path, "rb") as file_handle: content = file_handle.read() media_files.append( { "field_name": "media_files", "filename": os.path.basename(resolved_path), "content_type": mime_type, "content": content, } ) ``` ### Technical Analysis The documentation states that uploads should be limited to local workspace files explicitly attached by the user. The implementation does not enforce that trust boundary. `os.path.abspath(os.path.expanduser(raw_path))` accepts relative paths, absolute paths, home-directory paths, and ...[truncated 2539 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description emphasizes explicit engagement workflows: likes, follows, replies, and approved/OAuth-gated posting. The supplied code does not implement any write or engagement operations at all. Every exposed API method and CLI command is read-oriented, using GET requests to retrieve Twitter/X data; the only POST support is generic request plumbing and is never used by any command. The code therefore materially differs from the declared purpose: it is a read/discovery client, not an engagement/posting skill. The read-context portion of the description is partially accurate, but the core declared capabilities around acting on accounts/tweets/campaigns are absent.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The core domain matches: this is a Twitter/X engagement client using AIsa, and it supports read context via tweet listing plus engagement actions like like/unlike and follow/unfollow. However, the declared description explicitly claims support for replies and OAuth-gated/approved posting, and no such capabilities appear in this code chunk. The available commands and endpoints are limited to listing tweets, liking/unliking, following/unfollowing, and status inspection. Because the description includes materially broader engagement/posting capabilities than the code actually provides, this is a description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared description overstates the skill’s capabilities. The supplied code only talks to AIsa endpoints for Twitter authorization (/twitter/auth_twitter) and posting (/twitter/post_twitter), plus a local status command. Posting supports text splitting into threaded chunks, replies/quote-style chains, and media attachments, which aligns with the 'OAuth-gated posting' and part of 'replies' claim. However, there is no code for likes, follows, or reading Twitter context. Since those are explicitly named as supported engagement workflows, the description does not accurately represent the actual implemented behavior.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The post/status flows include the raw AISA API key in JSON output, which unnecessarily exposes a bearer credential to logs, terminals, calling agents, or downstream tooling. Because this key authorizes actions against the relay API, anyone who obtains it may be able to post content or invoke other AIsa-backed operations as the user/service.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The authorization command returns the raw AISA API key even though the operation only needs to show an authorization URL. This creates direct secret leakage during a highly likely user-visible flow, increasing the chance the bearer token is captured in terminal history, chat transcripts, CI logs, or agent memory.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The skill explicitly transmits user data, OAuth requests, uploaded local files, and the
AISA_API_KEY-authenticated traffic to a fixed third-party endpoint. Even when disclosed, this creates a real external transmission surface: sensitive tweet content, account metadata, and attached files leave the local environment and are exposed to the vendor's storage, logging, and processing practices.- Content
md - `AISA_API_KEY` is required for AIsa-backed API access. - Use repo-relative `scripts/` paths from the shipped package. - Twitter/X reads, OAuth requests, and user-approved media uploads use the fixed AIsa API endpoint `https://api.aisa.one/apis/v1/twitter`. - Provide only `AISA_API_KEY`; do not use passwords, cookies, or browser credential export. ## Example Requests
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md When the user asks to like, unlike, follow, or unfollow on X/Twitter: 1. Do not ask the user to manually paste tweet links or IDs. 2. If the user first asked to query tweets, keep the returned `tweets[]` structure in the current agent context. 3. Map ordinal follow-up requests to remembered tweet or author context. 4. If multiple user candidates match a natural-language name, stop and ask the user to confirm the account.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md When the user asks to like, unlike, follow, or unfollow on X/Twitter: 1. Do not ask the user to manually paste tweet links or IDs. 2. If the user first asked to query tweets, keep the returned `tweets[]` structure in the current agent context. 3. Map ordinal follow-up requests to remembered tweet or author context. 4. If multiple user candidates match a natural-language name, stop and ask the user to confirm the account.
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring explicitly describes 'Twitter/X read APIs for autonomous agents' and the implementation only issues GET requests to read endpoints throughout the CLI. That behavior is narrower than the manifest, which claims likes, follows, replies, and approved posting support, creating a semantic mismatch between the skill description and the actual code in this file.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The like and unlike handlers automatically resolve targets and submit engagement requests to remote endpoints without any user confirmation or warning at execution time. Because this skill is specifically designed to perform real Twitter/X engagement through an OAuth-gated relay, accidental invocation or ambiguous upstream agent behavior can produce unintended public actions from the connected account.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The client exposes follow and unfollow operations as immediate command handlers and forwards them directly to the relay without any built-in confirmation, approval gate, or safety interlock. In the context of a social-engagement skill that performs real account actions, this increases the risk of unintended or unauthorized account changes caused by prompt confusion, operator error, or misuse by an upstream agent.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python DEFAULT_TIMEOUT = 30 DEFAULT_BASE_URL = "https://api.aisa.one/apis/v1" DEFAULT_CHROME_USER_AGENT = ( "Mozilla/5.0 (Windows NT 10.0; Win64; x64) " "AppleWebKit/537.36 (KHTML, like Gecko) "
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python DEFAULT_TIMEOUT = 30 DEFAULT_BASE_URL = "https://api.aisa.one/apis/v1" DEFAULT_CHROME_USER_AGENT = ( "Mozilla/5.0 (Windows NT 10.0; Win64; x64) " "AppleWebKit/537.36 (KHTML, like Gecko) "
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The post flow sends tweet text, media IDs, and optionally uploaded file contents to the remote AIsa endpoint via HTTP requests. Although this is functionally expected for a posting client, the code does not provide a runtime warning, confirmation, or privacy disclosure before transmitting user content and local media files off-system.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The documentation repeatedly frames the client as 'Twitter/X read APIs' and gives only read-oriented usage examples. For a skill whose stated purpose includes likes, follows, replies, and OAuth-gated posting, this documentation actively communicates a different intent than the skill advertises.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code file sends usernames, tweet IDs, search queries, and similar inputs to https://api.aisa.one as part of its normal operation. Although the module docstring states it is a Twitter/X API client, there is no user-facing warning, confirmation, or runtime disclosure that these inputs are transmitted to a third-party service.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The configuration loader reads AISA_API_KEY from environment variables and uses it for Authorization headers in outbound requests. There is no nearby comment, prompt, or user-facing disclosure explaining that the skill consumes a sensitive credential and sends it to the remote service.
- Content
Static analysis
No suspicious patterns detected.