T09 · Insecure Skill Coding Practices
Error
- Location
scripts/twitter_oauth_client.py:306- Finding
API Key Disclosed Through Command Output
- Content
View full analysis
- Remediation
View remediation
Security audit
X/Twitter All-in-One: 30+ APIs, OAuth Post, One Key
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it says at a high level, but it exposes the configured API key in normal command output and can redirect posting traffic to arbitrary HTTP(S) relay URLs.
Review before installing. Only use this with an AIsa key you are willing to expose to command output/logs, avoid confidential monitoring terms unless the provider is approved, and do not set TWITTER_RELAY_BASE_URL unless you fully trust the destination. The publisher should remove API key fields from outputs, restrict relay URLs to trusted HTTPS hosts, and make quote/reply posting behavior explicit before this is treated as routine-risk.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/twitter_oauth_client.py:42- Finding
Configurable Relay Allows Credential and Media Exfiltration Over Arbitrary HTTP(S) Destinations
- Content
View full analysis
str: value = base_url.strip().rstrip("/") if not value: raise RelayConfigError("TWITTER_RELAY_BASE_URL is required.") parsed = urllib.parse.urlparse(value) if parsed.scheme not in {"http", "https"} or not parsed.netloc: raise RelayConfigError("TWITTER_RELAY_BASE_URL must be a valid http(s) URL.") return value def load_config(args: argparse.Namespace) -> Dict[str, Any]: base_url = normalize_base_url( get_env("TWITTER_RELAY_BASE_URL", DEFAULT_BASE_URL) ) aisa_api_key = getattr(args, "aisa_api_key", None) or get_env("AISA_API_KEY") timeout = getattr(args, "timeout", None) or int(get_env("TWITTER_RELAY_TIMEOUT", str(DEFAULT_TIMEOUT))) if not aisa_api_key: raise RelayConfigError("AISA_API_KEY is required.") return { "base_url": base_url, "aisa_api_key": aisa_api_key, "timeout": timeout, } ``` ```python def build_auth_headers(aisa_api_key: str, extra_headers: Optional[Dict[str, str]] = None) -> Dict[str, str]: headers = { "Authorization": f"Bearer {aisa_api_key}", "User-Agent": DEFAULT_CHROME_USER_AGENT, } if extra_headers: headers.update(extra_headers) return headers ``` ```python def post_single_tweet( config: Dict[str, Any], *, content: Optional[str] = None, media_ids: Optional[list[str]] = None, media_files: Optional[list[Dict[str, Any]]] = None, parent_tweet_id: Optional[str] = None, post_type: Optional[str] = None, ) -> Dict[str, Any]: payload: Dict[str, Any] = { "aisa_api_key": config["aisa_api_key"], } if content: payload["content" ...[truncated 3724 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (51)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The code substantially matches the read/search portion of the description: it supports profiles, timelines/tweets, mentions, followers, tweet search, trends, lists, communities, and Spaces. However, the description also claims the skill can publish posts after the user completes OAuth in the browser. In this code chunk, there is no post/create-tweet endpoint, no OAuth initiation/redirect/callback handling, and no browser-based auth flow despite importing webbrowser. Authentication is via an AISA_API_KEY bearer token, not user OAuth. Therefore the description overstates material capabilities that are not present in the supplied code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description materially overstates the skill's capabilities. In the provided code, the only network endpoints used are /twitter/auth_twitter and /twitter/post_twitter, plus a local status command. The code can obtain an authorization URL, optionally open it in a browser, and publish posts with optional media, quote/reply chaining, and chunking to fit Twitter length rules. There is no code for fetching profiles, timelines, mentions, followers, search results, trends, lists, communities, or Spaces. Because the declared primary purpose includes broad read/search functionality that is absent from the implementation, this is a clear description-behavior mismatch.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instruction to default to
--type quotefor publishing conflicts with earlier guidance that normal standalone posts should not include quote/reply relationship fields. In a posting skill, this can cause unintended quoting behavior, accidental inclusion of external tweet context, and publication of content in a different visibility/context than the user requested.- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code embeds the API key into ordinary post-operation responses, causing plain-text credential disclosure during normal use. In an agent-integrated environment this is especially dangerous because outputs may be visible to users, plugins, telemetry pipelines, or logs not intended to handle secrets.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The authorization command prints the API key alongside the authorization URL and raw response, disclosing a sensitive credential during a routine setup flow. This can leak the relay secret to shell history capture, CI logs, notebook outputs, or upstream agent traces.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The status command exposes the configured relay credential in cleartext even though the command's purpose is operational diagnostics, not secret inspection. This creates a straightforward disclosure path for anyone able to invoke the skill or read its output, enabling unauthorized use of the external relay service.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
The status command explicitly prints the configured API key in cleartext, creating a direct credential disclosure primitive. Because this skill is for Twitter/X operations rather than secret management, the exposure is unjustified and increases the blast radius if the command is invoked by an untrusted user or captured by logs.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill declares access to environment variables and makes many outbound network requests, but it does not define explicit tool scope such as allowed tools or permissions. That increases the blast radius if the skill is invoked in a broader agent environment, because access to secrets and external transmission are possible without a clear least-privilege boundary.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill sends user-supplied Twitter queries, usernames, IDs, and potentially monitoring targets to a third-party API service, but the description does not clearly disclose that external data sharing occurs. In a social listening context, those queries may reveal sensitive business interests, investigations, or user intent, so lack of disclosure can cause privacy and compliance issues.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This skill is explicitly designed to transmit data and an API bearer token to an external service at
api.aisa.one. That is expected functionality, but it is still security-relevant because any user-supplied query, monitored account, or identifier is disclosed to a third party, and the external dependency becomes part of the trust boundary.- Content
bash # Get user info curl "https://api.aisa.one/apis/v1/twitter/user/info?userName=elonmusk" \ -H "Authorization: Bearer $AISA_API_KEY" # Get user profile about (account country, verification, username changes)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This endpoint sends profile lookup parameters and the bearer token to a third-party API. In context, the skill is meant to do this, but the risk remains that user requests and credentials cross organizational boundaries without explicit least-privilege and disclosure controls.
- Content
md -H "Authorization: Bearer $AISA_API_KEY" # Get user profile about (account country, verification, username changes) curl "https://api.aisa.one/apis/v1/twitter/user_about?userName=elonmusk" \ -H "Authorization: Bearer $AISA_API_KEY" # Batch get user info by IDs
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
Batch user ID lookups transmit potentially large target sets to an external service, which can expose investigations, watchlists, or internal research priorities. Because authorization is via bearer token, mishandling request logging or telemetry could also leak credentials.
- Content
md -H "Authorization: Bearer $AISA_API_KEY" # Batch get user info by IDs curl "https://api.aisa.one/apis/v1/twitter/user/batch_info_by_ids?userIds=44196397,123456" \ -H "Authorization: Bearer $AISA_API_KEY" # Get user's latest tweets
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
Timeline retrieval sends monitored account selections and authentication data to a third-party API. In a competitive intelligence or monitoring use case, the chosen accounts themselves may be sensitive business information.
- Content
md -H "Authorization: Bearer $AISA_API_KEY" # Get user's latest tweets curl "https://api.aisa.one/apis/v1/twitter/user/last_tweets?userName=elonmusk" \ -H "Authorization: Bearer $AISA_API_KEY" # Get user mentions
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
Mention queries reveal which users or brands are being monitored and send that data to the external provider. The behavior is expected for the skill's purpose, but it creates privacy and business-intelligence exposure if not disclosed and controlled.
- Content
md -H "Authorization: Bearer $AISA_API_KEY" # Get user mentions curl "https://api.aisa.one/apis/v1/twitter/user/mentions?userName=elonmusk" \ -H "Authorization: Bearer $AISA_API_KEY" # Get user followers
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
Follower lookups send tracked handles and the bearer credential to the external service. This can expose relationship analysis targets and create dependency on a third-party processor for user interest graphs.
- Content
md -H "Authorization: Bearer $AISA_API_KEY" # Get user followers curl "https://api.aisa.one/apis/v1/twitter/user/followers?userName=elonmusk" \ -H "Authorization: Bearer $AISA_API_KEY" # Get user followings
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
Following-list lookups disclose monitored accounts and analysis intent to the API provider. While normal for this skill, the transfer is still security-relevant because it expands the trust boundary beyond the local agent runtime.
- Content
md -H "Authorization: Bearer $AISA_API_KEY" # Get user followings curl "https://api.aisa.one/apis/v1/twitter/user/followings?userName=elonmusk" \ -H "Authorization: Bearer $AISA_API_KEY" # Get user verified followers (requires user_id, not userName)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
Verified follower queries send user identifiers to a third-party API along with authentication. Bulk or repeated use could reveal target-selection logic or internal screening criteria.
- Content
md -H "Authorization: Bearer $AISA_API_KEY" # Get user verified followers (requires user_id, not userName) curl "https://api.aisa.one/apis/v1/twitter/user/verifiedFollowers?user_id=44196397" \ -H "Authorization: Bearer $AISA_API_KEY" # Check follow relationship between two users
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
Relationship checks between users can reveal internal hypotheses or investigative interests when sent to the external provider. The external service also receives the bearer token used to authorize access.
- Content
md -H "Authorization: Bearer $AISA_API_KEY" # Check follow relationship between two users curl "https://api.aisa.one/apis/v1/twitter/user/check_follow_relationship?source_user_name=elonmusk&target_user_name=BillGates" \ -H "Authorization: Bearer $AISA_API_KEY" # Search users by keyword
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
Keyword-based user searches transmit potentially sensitive search terms to the provider, which may disclose business strategies or investigative topics. This is expected behavior but requires transparent consent and privacy controls.
- Content
-H "Authorization: Bearer $AISA_API_KEY"
Search users by keyword
curl "https://api.aisa.one/apis/v1/twitter/user/search?query=AI+researcher"
-H "Authorization: Bearer $AISA_API_KEY"text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
Advanced tweet search sends free-form query text to a third-party endpoint, which may expose sensitive research topics, customer issues, or internal initiatives. Because the search is authenticated with a bearer key, careless logging creates additional credential exposure risk.
- Content
bash # Advanced tweet search (queryType is required: Latest or Top) curl "https://api.aisa.one/apis/v1/twitter/tweet/advanced_search?query=AI+agents&queryType=Latest" \ -H "Authorization: Bearer $AISA_API_KEY" # Search top tweets
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
Top-tweet search has the same security characteristics as other search endpoints: external disclosure of queries and reliance on third-party processing. In context, social listening can make the content of search terms especially sensitive.
- Content
md -H "Authorization: Bearer $AISA_API_KEY" # Search top tweets curl "https://api.aisa.one/apis/v1/twitter/tweet/advanced_search?query=AI+agents&queryType=Top" \ -H "Authorization: Bearer $AISA_API_KEY" # Get tweets by IDs (comma-separated)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
Tweet ID lookups transmit selected tweet targets and credentials to the provider. Even public tweet IDs can reveal what content the user is analyzing or tracking.
- Content
md -H "Authorization: Bearer $AISA_API_KEY" # Get tweets by IDs (comma-separated) curl "https://api.aisa.one/apis/v1/twitter/tweets?tweet_ids=1895096451033985024" \ -H "Authorization: Bearer $AISA_API_KEY" # Get tweet replies
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
Reply retrieval sends conversation targets to the provider and may reveal what threads are under investigation. The behavior is expected but still expands the data-sharing surface to an external dependency.
- Content
md -H "Authorization: Bearer $AISA_API_KEY" # Get tweet replies curl "https://api.aisa.one/apis/v1/twitter/tweet/replies?tweetId=1895096451033985024" \ -H "Authorization: Bearer $AISA_API_KEY" # Get tweet quotes
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
Quote lookup shares targeted tweet IDs and usage metadata with the external API. In aggregate, such requests can reveal monitoring priorities or brand-response workflows.
- Content
md -H "Authorization: Bearer $AISA_API_KEY" # Get tweet quotes curl "https://api.aisa.one/apis/v1/twitter/tweet/quotes?tweetId=1895096451033985024" \ -H "Authorization: Bearer $AISA_API_KEY" # Get tweet retweeters
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
Retweeter analysis sends the tweet target and authentication token to a third-party processor. This can expose audience-analysis interests and should be treated as sensitive operational metadata.
- Content
md -H "Authorization: Bearer $AISA_API_KEY" # Get tweet retweeters curl "https://api.aisa.one/apis/v1/twitter/tweet/retweeters?tweetId=1895096451033985024" \ -H "Authorization: Bearer $AISA_API_KEY" # Get tweet thread context (full conversation thread)
Static analysis
No suspicious patterns detected.