Security audit

Twitter

Security checks for vulnerabilities and agentic risk

Overview

This Twitter/X skill mostly matches its stated purpose, but it needs review because it can change an account and exposes the API key in normal script output and to configurable relay URLs.

Install only if you trust AIsa with your Twitter/X queries, posts, engagement targets, API key, and any media you upload. Use a dedicated, revocable API key, avoid custom relay URLs unless they are trusted HTTPS endpoints, and treat any prior status/authorize/post output as potentially containing a leaked key that should be rotated.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/twitter_oauth_client.py:343
Finding: API Key Disclosed in Command Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/twitter_oauth_client.py:47
Finding: Credentials and Sensitive Content Can Be Sent to Arbitrary or Cleartext Relay Endpoints
Content: View full analysis
str: value = base_url.strip().rstrip("/") if not value: raise RelayConfigError("TWITTER_RELAY_BASE_URL is required.") parsed = urllib.parse.urlparse(value) if parsed.scheme not in {"http", "https"} or not parsed.netloc: raise RelayConfigError("TWITTER_RELAY_BASE_URL must be a valid http(s) URL.") return value ``` ```python # scripts/twitter_oauth_client.py:81-85 def build_auth_headers(aisa_api_key: str, extra_headers: Optional[Dict[str, str]] = None) -> Dict[str, str]: headers = { "Authorization": f"Bearer {aisa_api_key}", "User-Agent": DEFAULT_CHROME_USER_AGENT, } ``` ```python # scripts/twitter_oauth_client.py:382-409 payload: Dict[str, Any] = { "aisa_api_key": config["aisa_api_key"], } if content: payload["content"] = content if post_type: payload["type"] = post_type if media_ids: payload["media_ids"] = media_ids if parent_tweet_id: parent_key = "in_reply_to_tweet_id" if post_type == "reply" else "quote_tweet_id" payload[parent_key] = parent_tweet_id endpoint = f"{config['base_url']}/post_twitter" if media_files: return send_multipart_request( endpoint, payload, media_files, timeout=config["timeout"], aisa_api_key=config["aisa_api_key"], ) return send_json_request( endpoint, payload, timeout=config["timeout"], aisa_api_key=config["aisa_api ...[truncated 4571 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (55)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The code substantially matches the read/search portion of the description: it accesses Twitter/X data such as profiles, timelines, mentions, followers, tweet search, trends, lists, communities, and Spaces. However, the description also states the skill can perform authenticated write actions (post, like/unlike, follow/unfollow) after the user completes OAuth in the browser. This code contains no such functionality: there are no endpoints or methods for creating posts, liking, unliking, following, unfollowing, or initiating/completing OAuth. Authentication is only via an AISA_API_KEY bearer token, not user OAuth. Therefore the declared description overstates important capabilities and is materially inaccurate.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description presents a comprehensive Twitter/X read-and-write skill. This code chunk only supports a limited subset: user resolution, listing recent tweets for a user, liking/unliking tweets, following/unfollowing users, and a status command. There is no implementation for publishing posts, reading mentions/followers/trends/lists/communities/Spaces, or general tweet search in this chunk. While partial overlap exists with like/unlike/follow/unfollow and reading a user's recent tweets, the declared description materially overstates the implemented functionality, so this should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description presents a broad Twitter/X integration with both read and interaction capabilities across many resource types. This code chunk does not implement those read capabilities or most of the interaction capabilities. It only calls two relay endpoints: /auth_twitter and /post_twitter, plus a local status command. Its substantive behavior is limited to OAuth initiation and tweet publishing, including media attachment and thread/quote/reply handling. Because the declared description significantly overstates the implemented functionality in this code chunk, this is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The status command returns the configured aisa_api_key in plaintext, which unnecessarily exposes a sensitive credential to anyone who can invoke the command or view its output/logs. Because this client performs authenticated relay actions for Twitter engagement, disclosure of that key could let an attacker reuse the relay credential to perform unauthorized actions or access related backend functionality.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Exposing the configured API key via a normal informational command, especially without any warning or privileged gating, creates an easy secret-disclosure path. In an agent/skill context, command output may be surfaced to users, other tools, traces, or logs, greatly increasing the chance that the credential leaks beyond its intended boundary.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The client includes the configured AISA API key in normal command output, which exposes a bearer secret to logs, terminal history, calling agents, and any downstream components that capture stdout. In this skill context, the key is unrelated to the user-visible Twitter task and can enable unauthorized use of the relay service if copied.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The authorize flow returns an authorization URL along with the full configured AISA API key, unnecessarily disclosing a sensitive relay credential during a routine OAuth step. Because authorization commands are likely to be surfaced to users or orchestration logs, this creates a straightforward secret leakage path.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The status command reveals the configured relay API key even though status reporting only requires non-sensitive configuration details. Status endpoints are commonly used for diagnostics and automation, making them especially likely to leak secrets into chat transcripts, monitoring systems, and debug logs.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill declares network and environment-variable dependent behavior but does not define any explicit tool scope such as allowed-tools or permissions. That omission weakens least-privilege controls and makes it easier for an agent runtime to grant broader access than users may expect, especially because the skill is designed to contact external services and use secrets.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill advertises account-impacting actions such as posting, liking, following, and unfollowing without a prominent warning that these actions transmit data to a third-party relay and can directly alter the user's Twitter account. In an agent setting, weak disclosure increases the risk of users authorizing actions they do not fully understand or did not intend.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: This skill is designed to send requests, including an API bearer token, to the external domain api.aisa.one, and the optional relay configuration is also externally hosted. External transmission is expected for this skill's function, but it remains security-relevant because user queries, metadata, and secrets may be disclosed to a third-party service.
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
export AISA_API_KEY="your-key"

Optional: override the default AIsa relay for OAuth, posting, and engagement

export TWITTER_RELAY_BASE_URL="https://api.aisa.one/apis/v1/twitter" export TWITTER_RELAY_TIMEOUT="30"

text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The documented curl command transmits data and an Authorization bearer token to api.aisa.one. While necessary for the advertised service, this creates a real trust boundary where prompts, targets, and credentials leave the local environment and are exposed to the external provider.
Content: Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.
bash
# Get user info curl "https://api.aisa.one/apis/v1/twitter/user/info?userName=elonmusk" \ -H "Authorization: Bearer $AISA_API_KEY" # Get user profile about (account country, verification, username changes)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: This endpoint usage sends profile lookup data and an API credential to an external service. In context this is intended behavior, but it is still a genuine data egress and trust-boundary concern because all requested user information and access credentials are handled by a third party.
Content: Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.
md
-H "Authorization: Bearer $AISA_API_KEY" # Get user profile about (account country, verification, username changes) curl "https://api.aisa.one/apis/v1/twitter/user_about?userName=elonmusk" \ -H "Authorization: Bearer $AISA_API_KEY" # Batch get user info by IDs

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The batch info example demonstrates transmission of identifiers and an Authorization token to the external AIsa API. Because this centralizes social graph queries through a third party, it has privacy and monitoring implications beyond purely local skill behavior.
Content: Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.
md
-H "Authorization: Bearer $AISA_API_KEY" # Batch get user info by IDs curl "https://api.aisa.one/apis/v1/twitter/user/batch_info_by_ids?userIds=44196397,123456" \ -H "Authorization: Bearer $AISA_API_KEY" # Get user's latest tweets

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: Fetching a user's tweets requires sending the target username and API credential to an external endpoint. This is expected functionality, but still a true security-relevant issue because user requests and access tokens are exposed outside the agent's local trust boundary.
Content: Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.
md
-H "Authorization: Bearer $AISA_API_KEY" # Get user's latest tweets curl "https://api.aisa.one/apis/v1/twitter/user/last_tweets?userName=elonmusk" \ -H "Authorization: Bearer $AISA_API_KEY" # Get user mentions

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The mentions endpoint sends lookup targets and credentials to api.aisa.one. This is not covert exfiltration, but it is external transmission of potentially sensitive investigative or monitoring intent, which matters in enterprise or regulated environments.
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
md
-H "Authorization: Bearer $AISA_API_KEY" # Get user mentions curl "https://api.aisa.one/apis/v1/twitter/user/mentions?userName=elonmusk" \ -H "Authorization: Bearer $AISA_API_KEY" # Get user followers

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: Retrieving followers sends usernames plus the bearer token to the external provider. Because follower analysis can reveal business interest or monitoring targets, this outbound transmission has real privacy and operational sensitivity.
Content: Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.
md
-H "Authorization: Bearer $AISA_API_KEY" # Get user followers curl "https://api.aisa.one/apis/v1/twitter/user/followers?userName=elonmusk" \ -H "Authorization: Bearer $AISA_API_KEY" # Get user followings

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: This command transmits followings queries and API credentials to an external relay/API provider. Even though it matches the stated purpose of the skill, it remains a genuine egress risk because relationship-analysis targets may be sensitive.
Content: Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.
md
-H "Authorization: Bearer $AISA_API_KEY" # Get user followings curl "https://api.aisa.one/apis/v1/twitter/user/followings?userName=elonmusk" \ -H "Authorization: Bearer $AISA_API_KEY" # Get user verified followers (requires user_id, not userName)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The verified-followers example sends a numeric user ID and authorization secret to the AIsa API. That is expected for this service model, but it still creates a third-party dependency and exposure path for credentials and lookup targets.
Content: Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.
md
-H "Authorization: Bearer $AISA_API_KEY" # Get user verified followers (requires user_id, not userName) curl "https://api.aisa.one/apis/v1/twitter/user/verifiedFollowers?user_id=44196397" \ -H "Authorization: Bearer $AISA_API_KEY" # Check follow relationship between two users

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: Checking follow relationships transmits both source and target account names to the external API along with the bearer token. This can reveal internal investigative interests or business intelligence targets to the provider, so it is a real security consideration.
Content: Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.
md
-H "Authorization: Bearer $AISA_API_KEY" # Check follow relationship between two users curl "https://api.aisa.one/apis/v1/twitter/user/check_follow_relationship?source_user_name=elonmusk&target_user_name=BillGates" \ -H "Authorization: Bearer $AISA_API_KEY" # Search users by keyword

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: User search requests send the search query and authorization token to api.aisa.one. Search terms may contain commercially sensitive topics, making this an actual external transmission issue despite being core functionality.
Content: Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.
-H "Authorization: Bearer $AISA_API_KEY"

Search users by keyword

curl "https://api.aisa.one/apis/v1/twitter/user/search?query=AI+researcher"
-H "Authorization: Bearer $AISA_API_KEY"

text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: Advanced tweet search sends potentially sensitive search terms plus the API key to an external service. In an agent environment, those terms can encode strategy, investigations, or private user intent, so this is a genuine egress concern.
Content: Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.
bash
# Advanced tweet search (queryType is required: Latest or Top) curl "https://api.aisa.one/apis/v1/twitter/tweet/advanced_search?query=AI+agents&queryType=Latest" \ -H "Authorization: Bearer $AISA_API_KEY" # Search top tweets

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The top-search variant has the same external transmission risk: query text and credentials are sent to api.aisa.one. The behavior is consistent with the skill's purpose, but still security-relevant because it exports user intent to a third-party provider.
Content: Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.
md
-H "Authorization: Bearer $AISA_API_KEY" # Search top tweets curl "https://api.aisa.one/apis/v1/twitter/tweet/advanced_search?query=AI+agents&queryType=Top" \ -H "Authorization: Bearer $AISA_API_KEY" # Get tweets by IDs (comma-separated)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: Tweet-ID lookup sends identifiers and a bearer credential to an external API. This is not inherently malicious, but it is a real trust-boundary crossing that should be treated as a vulnerability from a data-governance and secret-handling perspective.
Content: Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.
md
-H "Authorization: Bearer $AISA_API_KEY" # Get tweets by IDs (comma-separated) curl "https://api.aisa.one/apis/v1/twitter/tweets?tweet_ids=1895096451033985024" \ -H "Authorization: Bearer $AISA_API_KEY" # Get tweet replies

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: Reply retrieval exports the tweet ID and authorization token to the third-party service. Because this reveals what conversations the agent is analyzing, it is a meaningful privacy and intelligence-leakage consideration.
Content: Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.
md
-H "Authorization: Bearer $AISA_API_KEY" # Get tweet replies curl "https://api.aisa.one/apis/v1/twitter/tweet/replies?tweetId=1895096451033985024" \ -H "Authorization: Bearer $AISA_API_KEY" # Get tweet quotes

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Tp4

Tp4

Context-Inappropriate Capability

Missing User Warnings

Context-Inappropriate Capability

Context-Inappropriate Capability

Context-Inappropriate Capability

Undeclared Tool Scope

Missing User Warnings

External Transmission

Optional: override the default AIsa relay for OAuth, posting, and engagement

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Search users by keyword

External Transmission

External Transmission

External Transmission

External Transmission

Static analysis