X to Kindle

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:30 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for sending X/Twitter posts to Kindle, but it under-protects an email app password and sends post data through third-party services without enough safety guidance.

Review before installing. Use a dedicated low-risk email account and a protected secret store instead of TOOLS.md for SMTP credentials. Be aware that fxtwitter and the configured email provider may see the requested post or related metadata. Prefer adding explicit consent, HTML escaping, and URL validation before using this with sensitive content.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:41
• Finding: Plaintext Storage of Gmail App Password<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 41-49 **Vulnerability Type**: Plaintext credential storage **Risk Level**: High ### Vulnerable Code ```markdown Store in TOOLS.md: ```markdown ## Kindle - Address: [e-mail] ## Email (Gmail SMTP) - From: [e-mail] - App Password: xxxx xxxx xxxx xxxx - Host: smtp.gmail.com - Port: 587 ``` ``` ### Technical Analysis The skill explicitly instructs users to store a Gmail App Password in `TOOLS.md`, a plaintext Markdown file in the working environment. This provides no encryption, access isolation, or secret lifecycle controls. The file could be exposed through source-control commits, workspace synchronization, backups, diagnostic bundles, agent context collection, logs, or access by other local users and processes. The configuration also exposes the sender email address and private Kindle delivery address. An App Password is a reusable authentication credential. Depending on the Gmail account configuration and enabled protocols, disclosure may permit SMTP authentication and potentially access to other mail protocols that accept the same credential. ### Attack Path 1. A user follows the skill instructions and writes a valid Gmail App Password into `TOOLS.md`. 2. The file is accidentally committed, synchronized, backed up, included in an agent context, or read by another local process or user. 3. An attacker extracts the sender address and App Password. 4. The attacker authenticates to the applicable Gmail service using the stolen credential. 5. The attacker sends unauthorized email or accesses other enabled mail services within the credential's effective scope. 6. The exposed Kindle address may also be targeted with unsolicited document deliveries if the attacker's sender is authorized by the Kindle account. ### Impact Assessment Successful exploitation may provide unauthorized authenticated use of the configured email account. At minimum, the attacker may be able to send m ...[truncated 422 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not store passwords, tokens, or App Passwords in `TOOLS.md` or any other project documentation. - Retrieve the SMTP credential at runtime from an operating-system keychain, managed secret store, or equivalent protected credential provider. - If environment variables are unavoidable, load them from a file excluded from source control and restrict that file to the owning user, such as mode `0600` on Unix-like systems. - Add secret-bearing files and local configuration files to `.gitignore`. - Ensure credentials are redacted from logs, exceptions, tool output, generated reports, and agent context. - Use a dedicated email account with the minimum capabilities needed for Kindle delivery rather than a primary personal account. - Document credential revocation and rotation procedures. - Immediately revoke any App Password that has already been committed, logged, synchronized, or otherwise exposed. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:19
• Finding: Unescaped External Data Inserted into HTML Email<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 19-33 **Vulnerability Type**: HTML injection through unescaped external content **Risk Level**: Medium ### Vulnerable Code ```markdown 1. **Extract content** via fxtwitter API: ``` https://api.fxtwitter.com/status/<tweet_id> ``` Extract from URL: `twitter.com/*/status/<id>` or `x.com/*/status/<id>` 2. **Format as HTML email**: ```html <html> <body> <h1>@{author_handle}</h1> <p>{tweet_text}</p> <p><em>{timestamp}</em></p> <p><a href="{original_url}">View on X</a></p> </body> </html> ``` ``` ### Technical Analysis The template inserts `author_handle`, `tweet_text`, `timestamp`, and `original_url` into HTML without requiring context-appropriate encoding or sanitization. These values originate from a user-selected external post, its URL, or the third-party FxTwitter API and therefore cross a trust boundary. Text placed inside elements must be HTML-escaped. The `original_url` value is more sensitive because it is inserted into an HTML attribute and requires attribute encoding plus strict scheme and host validation. Without these controls, crafted characters or markup could terminate the intended context and add attacker-controlled HTML. The exact behavior depends on the implementation used to construct the message and the receiving email client's sanitization. Modern clients commonly block scripts, but malicious markup may still create deceptive links, external tracking resources, misleading content, or malformed document output. ### Attack Path 1. An attacker creates or identifies an X/Twitter post containing markup-like content, or supplies a specially crafted post URL. 2. The victim asks the skill to send that post to Kindle. 3. The workflow retrieves attacker-influenced fields through `api.fxtwitter.com`. 4. The implementation interpolates the fields directly into the documented HTML template without encoding or sanitization. 5. The ...[truncated 834 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - HTML-escape `author_handle`, `tweet_text`, and `timestamp` before inserting them into element content. - Apply HTML attribute encoding to every value inserted into an attribute. - Parse and validate `original_url` rather than copying it directly into the template. - Permit only HTTPS URLs on expected hosts such as `x.com` and `twitter.com`. - Reject URLs containing embedded credentials, unexpected ports, control characters, or unsupported schemes. - Construct the message with a template engine that performs automatic context-sensitive escaping. - Sanitize the final HTML with a restrictive allowlist of required elements and attributes. - Disallow scripts, event-handler attributes, forms, embedded frames, styles, and externally loaded images or other resources. - Add tests using payloads containing quotes, angle brackets, entity encodings, malformed URLs, and attribute-breaking sequences. - Consider generating a plain-text email or safely escaped text-based document when rich HTML is not required. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The workflow sends user-supplied X/Twitter content to a third-party API and then forwards the extracted content via SMTP email, but it does not disclose that user data and link metadata will be transmitted to external services. This creates a privacy and compliance risk because users may not realize their requested content is being processed by fxtwitter and their email provider before reaching Kindle.

External Transmission

Medium

• Category: Data Exfiltration

Content

1. **Extract content** via fxtwitter API:
   ```
   https://api.fxtwitter.com/status/<tweet_id>
   ```
   Extract from URL: `twitter.com/*/status/<id>` or `x.com/*/status/<id>`

• Confidence: 82% confidence
• Finding: This step causes external transmission of user-requested content to api.fxtwitter.com, a third-party service outside the agent's control. While the integration appears functional rather than overtly malicious, it still introduces privacy, availability, and trust risks because tweet identifiers, request metadata, and potentially user intent are disclosed to an external endpoint.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs storing a Gmail App Password and Kindle email address in TOOLS.md, but provides no guidance that these are sensitive secrets requiring protected storage and restricted access. In an agent environment, documenting credentials in a broadly readable tool/config file can lead to credential exposure, unauthorized email sending, and account abuse.

External Transmission

Medium

• Category: Data Exfiltration

Content

User sends: `https://x.com/elonmusk/status/1234567890`

1. Fetch `https://api.fxtwitter.com/status/1234567890`
2. Extract author, text, timestamp
3. Send HTML email to Kindle address
4. Confirm: "Sent to Kindle 📚"

• Confidence: 80% confidence
• Finding: The example operationalizes the same external transmission pattern by instructing the agent to fetch tweet content from api.fxtwitter.com and then email it onward. Even as an example, it reinforces a workflow that exports user-requested data to third parties without any privacy warning, making the risky behavior more likely to be implemented as-is.

Static analysis

No suspicious patterns detected.