X Twitter Command Center (Search + Post + Interact)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:13 AM UTC
• Version: 1.0.6

Overview

This Twitter/X automation skill is coherent, but it exposes the configured AIsa API key in command output and allows relay traffic to be redirected to arbitrary HTTP(S) hosts.

Review this carefully before installing. Use only a low-privilege or disposable AIsa key if possible, avoid running status or authorize commands until the key-printing issue is fixed, do not set TWITTER_RELAY_BASE_URL except to a trusted HTTPS endpoint, and treat post/like/follow examples as live changes to the authorized Twitter/X account.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/twitter_oauth_client.py:337

Finding

API Key Disclosed in Command Output

Content

View full analysis

None: config = load_config(args) response = { "ok": True, "relay_base_url": config["base_url"], "aisa_api_key": config["aisa_api_key"], "timeout": config["timeout"], "supported_commands": ["authorize", "post", "status"], "supported_endpoints": ["/auth_twitter", "/post_twitter"], "media_upload": { "field_name": "media_files", "transport": "multipart/form-data", "supported_media_types": ...[truncated 3014 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/twitter_oauth_client.py:44

Finding

Configurable HTTP Relay Enables Credential and Content Redirection

Content

View full analysis

str: value = base_url.strip().rstrip("/") if not value: raise RelayConfigError("TWITTER_RELAY_BASE_URL is required.") parsed = urllib.parse.urlparse(value) if parsed.scheme not in {"http", "https"} or not parsed.netloc: raise RelayConfigError("TWITTER_RELAY_BASE_URL must be a valid http(s) URL.") return value ``` ```python # scripts/twitter_oauth_client.py:54-68 def load_config(args: argparse.Namespace) -> Dict[str, Any]: base_url = normalize_base_url( get_env("TWITTER_RELAY_BASE_URL", DEFAULT_BASE_URL) ) aisa_api_key = getattr(args, "aisa_api_key", None) or get_env("AISA_API_KEY") timeout = getattr(args, "timeout", None) or int(get_env("TWITTER_RELAY_TIMEOUT", str(DEFAULT_TIMEOUT))) if not aisa_api_key: raise RelayConfigError("AISA_API_KEY is required.") return { "base_url": base_url, "aisa_api_key": aisa_api_key, "timeout": timeout, } ``` ```python # scripts/twitter_oauth_client.py:78-103 def build_auth_headers(aisa_api_key: str, extra_headers: Optional[Dict[str, str]] = None) -> Dict[str, str]: headers = { "Authorization": f"Bearer {aisa_api_key}", "User-Agent": DEFAULT_CHROME_USER_AGENT, } if extra_headers: headers.update(extra_headers) return headers def send_json_request( url: str, payload: Dict[str, Any], timeout: int, aisa_api_key: str, ) -> Dict[str, Any]: request = urllib.request.Request( url, data=json.dumps(payload).encode( ...[truncated 4539 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (51)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared scope includes extensive read operations and authenticated engagement actions, but the file does not actually implement most of them here and instead points to other files. This creates an auditability problem where reviewers cannot verify the safety of the promised high-risk actions from the main skill entrypoint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared scope includes extensive read operations and authenticated engagement actions, but the file does not actually implement most of them here and instead points to other files. This creates an auditability problem where reviewers cannot verify the safety of the promised high-risk actions from the main skill entrypoint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared scope includes extensive read operations and authenticated engagement actions, but the file does not actually implement most of them here and instead points to other files. This creates an auditability problem where reviewers cannot verify the safety of the promised high-risk actions from the main skill entrypoint.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instructions create a dangerous contradiction: they default all publishing to --type quote, while other parts of the skill say normal standalone posts should omit relationship fields and quote mode requires an explicit quoted tweet URL. In a posting skill that performs real external actions, this inconsistency can cause unintended quote tweets, malformed requests, or posting behavior that does not match the user's intent, increasing the risk of accidental public actions.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code plainly exposes a configured authentication secret via a user-invokable command, which is a direct credential leak rather than a hypothetical weakness. In an agent skill, command outputs are commonly propagated across toolchains, chat transcripts, observability systems, or stored artifacts, so a single invocation can spread the secret widely. Since this tool can trigger authenticated Twitter relay actions, compromise of the key may permit unauthorized actions, abuse of paid services, or impersonation through the relay.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README advertises capabilities to read, engage, write, and post to Twitter/X but does not clearly warn that these actions can trigger real, live changes on a user's account after OAuth authorization. In an autonomous-agent context, users may treat documentation examples as informational rather than operational, increasing the risk of unintended posts, follows, likes, or other account activity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The quick-start commands for posting, liking, and following are presented as copy-paste examples without an explicit caution that they execute real account actions immediately. In a skill intended for autonomous agents, this omission is dangerous because operators may run examples during testing and unintentionally publish content or alter account state on production social media accounts.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill declares environment and network capabilities but does not define an explicit permission or allowed-tools scope. That makes the effective execution boundary ambiguous, increasing the chance an agent invokes external network access or reads secrets more broadly than a reviewer or user expects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The invocation guidance is broad enough to match many ordinary Twitter/X-related requests, which can cause the skill to be selected frequently even when users may not expect third-party API calls or automation. In a skill with networked data access and possible write actions, overbroad routing materially raises the chance of unintended data sharing or actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description does not clearly warn that user queries and targets will be sent to an external service for Twitter lookups. Because the skill is positioned for social listening and monitoring, users may inadvertently send sensitive company, customer, or investigative queries to a third party without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

This endpoint sends requested Twitter user data to api.aisa.one together with a bearer API key, creating a clear external data transmission path. In context, the skill is explicitly designed for third-party Twitter retrieval, so the main risk is privacy and secret-handling rather than hidden exfiltration.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

bash

# Get user info
curl "https://api.aisa.one/apis/v1/twitter/user/info?userName=elonmusk" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get user profile about (account country, verification, username changes)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

This endpoint transmits profile lookup data to an external provider using bearer authentication. While expected for the skill's function, it still exposes user-supplied targets and query context to a third party and depends on secure handling of the API key.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

-H "Authorization: Bearer $AISA_API_KEY"

# Get user profile about (account country, verification, username changes)
curl "https://api.aisa.one/apis/v1/twitter/user_about?userName=elonmusk" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Batch get user info by IDs

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

Batch user info requests send potentially multiple identifiers to a third-party service along with the API credential. Bulk lookups can amplify privacy impact because they may reveal larger relationship datasets or investigative targets in a single request.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

-H "Authorization: Bearer $AISA_API_KEY"

# Batch get user info by IDs
curl "https://api.aisa.one/apis/v1/twitter/user/batch_info_by_ids?userIds=44196397,123456" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get user's latest tweets

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

Recent tweet retrieval causes external transmission of the target username and associated request metadata to api.aisa.one. This is functionally intended but still means user requests are observable by a third-party provider and governed by that provider's retention practices.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md

-H "Authorization: Bearer $AISA_API_KEY"

# Get user's latest tweets
curl "https://api.aisa.one/apis/v1/twitter/user/last_tweets?userName=elonmusk" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get user mentions

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

Mention lookups transmit queried account information to a third-party API. In social listening contexts, this may expose sensitive monitoring interests, campaigns, or internal research topics even if the queried Twitter data is public.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

-H "Authorization: Bearer $AISA_API_KEY"

# Get user mentions
curl "https://api.aisa.one/apis/v1/twitter/user/mentions?userName=elonmusk" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get user followers

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

Follower lookups send target account information externally, which can reveal whom the user is investigating or tracking. The transmission is expected for functionality, but the absence of strong disclosure and scope controls makes it a real privacy concern.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md

-H "Authorization: Bearer $AISA_API_KEY"

# Get user followers
curl "https://api.aisa.one/apis/v1/twitter/user/followers?userName=elonmusk" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get user followings

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

Following-list retrieval transmits the username and request details to an outside service. This is not covert exfiltration, but it is still a genuine external transfer that can leak user investigative intent and should be treated as a privacy-sensitive operation.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

-H "Authorization: Bearer $AISA_API_KEY"

# Get user followings
curl "https://api.aisa.one/apis/v1/twitter/user/followings?userName=elonmusk" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get user verified followers (requires user_id, not userName)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

Verified follower lookup shares a user ID with the third-party API and authenticates using the AISA key. Even public-data queries become a privacy/control concern when performed through an external intermediary without clear consent messaging.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md

-H "Authorization: Bearer $AISA_API_KEY"

# Get user verified followers (requires user_id, not userName)
curl "https://api.aisa.one/apis/v1/twitter/user/verifiedFollowers?user_id=44196397" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Check follow relationship between two users

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

Relationship checks send both source and target usernames to the external provider, revealing social graph analysis interests. Because this can expose potentially sensitive intelligence-gathering patterns, the transmission risk is meaningful in context.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

-H "Authorization: Bearer $AISA_API_KEY"

# Check follow relationship between two users
curl "https://api.aisa.one/apis/v1/twitter/user/check_follow_relationship?source_user_name=elonmusk&target_user_name=BillGates" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Search users by keyword

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

User search sends free-form query text to api.aisa.one, which may include confidential product names, incident terms, or internal investigation topics. The ability to transmit arbitrary search terms externally makes this a genuine privacy exposure, especially without an explicit warning.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

-H "Authorization: Bearer $AISA_API_KEY"

Search users by keyword

curl "https://api.aisa.one/apis/v1/twitter/user/search?query=AI+researcher"
-H "Authorization: Bearer $AISA_API_KEY"

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

Advanced tweet search transmits arbitrary query strings externally using the bearer credential. In practice, users may enter commercially sensitive or investigative phrases, so the risk is not the network call itself but undisclosed third-party exposure of search intent.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

bash

# Advanced tweet search (queryType is required: Latest or Top)
curl "https://api.aisa.one/apis/v1/twitter/tweet/advanced_search?query=AI+agents&queryType=Latest" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Search top tweets

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

Top tweet search uses the same third-party transmission model and exposes free-form search content to api.aisa.one. Since this skill is broadly invokable for social listening, the operational context makes such query leakage more dangerous than a simple public-data fetch might suggest.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md

-H "Authorization: Bearer $AISA_API_KEY"

# Search top tweets
curl "https://api.aisa.one/apis/v1/twitter/tweet/advanced_search?query=AI+agents&queryType=Top" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get tweets by IDs (comma-separated)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

Tweet ID lookups send identifiers to an external service, which can disclose what content a user is examining. Although less sensitive than arbitrary text search, this still creates an observable trail of user interests and relies on safe handling of the API credential.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md

-H "Authorization: Bearer $AISA_API_KEY"

# Get tweets by IDs (comma-separated)
curl "https://api.aisa.one/apis/v1/twitter/tweets?tweet_ids=1895096451033985024" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get tweet replies

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

Reply retrieval sends the selected tweet ID to a third-party provider, exposing analysis targets outside the local environment. In investigation or monitoring workflows, that external visibility can itself be sensitive even when the source tweets are public.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md

-H "Authorization: Bearer $AISA_API_KEY"

# Get tweet replies
curl "https://api.aisa.one/apis/v1/twitter/tweet/replies?tweetId=1895096451033985024" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get tweet quotes

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

Quote-tweet retrieval transmits the requested tweet identifier externally via the AISA API. The skill context makes this a true privacy-related issue because routine use may leak internal monitoring focus to a third-party service.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md

-H "Authorization: Bearer $AISA_API_KEY"

# Get tweet quotes
curl "https://api.aisa.one/apis/v1/twitter/tweet/quotes?tweetId=1895096451033985024" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get tweet retweeters