GenViral Social Media

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:56 AM UTC
• Version: 1.0.0

Overview

The skill itself only generates text, but it installs broad, unused dependencies for posting and learning that are not clearly scoped or justified.

Review this skill before installing. The current code appears limited to generating a text string, but installation may bring in extra packages for X posting and self-improving behavior that the skill does not use or clearly scope. Prefer a version that removes those dependencies, pins reviewed versions, and documents any future posting behavior as explicit user-directed actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: dependencies.json:2

Finding

Unused and Non-Deterministically Versioned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: dependencies.json:2-5
Vulnerability Type: Unnecessary supply-chain exposure through unused dependencies and permissive version ranges
Risk Level: Low

Vulnerable Code

json

"dependencies": {
  "x-twitter": "^2.3.1",
  "self-improving-agent": "^3.0.1"
}

The dependencies are also presented as required components in README.md:11-13:

markdown

## Dependencies
- x-twitter (for posting)
- self-improving-agent (for learning)

Technical Analysis

Neither dependency is imported or used by index.js. The implemented generateViralPost() function only constructs and returns a local string, so posting and learning packages are unnecessary for the current behavior.

Both packages use caret version ranges, allowing the package resolver to install newer compatible releases. No integrity-checked lockfile is present in the audited project. This makes installations non-deterministic and unnecessarily expands the trusted third-party code and transitive dependency surface.

The audit did not establish that either named package is currently malicious or contains an installation hook. The vulnerability is the avoidable exposure created by installing unused, non-exactly-versioned third-party components.

Attack Path

1. A user installs the Skill using the documented installation process.
2. The package manager resolves versions permitted by ^2.3.1 and ^3.0.1.
3. Newer package versions or transitive dependencies may be selected because no audited lockfile constrains the dependency graph.
4. If an allowed dependency release or transitive component becomes compromised, malicious code could run through a package lifecycle script or when the affected component is loaded.
5. Such code would execute under the privileges and network access of the account performing the installation or running the agent.

This exploitation path depends on a compromised ...[truncated 534 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove x-twitter and self-improving-agent because the current implementation does not use them.
2. If either dependency becomes necessary, document the exact feature requiring it and import only the minimum required API.
3. Pin dependencies to exact reviewed versions rather than permissive caret ranges.
4. Commit an integrity-checked lockfile so installations use a reproducible dependency graph.
5. Review direct and transitive packages for lifecycle scripts, known vulnerabilities, ownership changes, and unexpected network or filesystem behavior.
6. Disable package installation scripts where operationally possible.
7. Run installation and execution in a least-privileged, isolated environment without unnecessary credentials or host filesystem access.
8. Add automated dependency auditing and update dependencies only after reviewing the resulting lockfile changes.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README advertises capabilities to post via x-twitter and to use a self-improving agent, which exceed the stated purpose of merely generating social media content with trend and hashtag optimization. This capability expansion is dangerous because autonomous posting and self-modification introduce opportunities for unauthorized actions, data leakage, abuse of connected accounts, and behavior drift beyond user expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The dependency on self-improving-agent is not aligned with the stated purpose of generating social media posts, trend analysis, and hashtag optimization. A self-improving agent can introduce autonomous behavior changes, expand capability scope, and create hard-to-audit execution paths, which increases the risk of unexpected actions or abuse if the package is compromised or misused.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The code comment is written only in Japanese ("ここにAI生成ロジック（GrokやLLM統合）"), which is a natural-language locale choice with no indication that users or maintainers can opt into another language. Under the stated policy, forced language selection without opt-in can be a policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.