Security audit

Twitter Thread Coach

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only Twitter/X writing coach, with some marketing advice users should apply carefully around privacy and platform rules.

Reasonable to install as a writing and marketing coach. Before using its advice publicly, review posts yourself, avoid sharing private messages or emails without consent and redaction, do not automate unsolicited DMs, and treat platform-growth claims as suggestions rather than guaranteed or policy-safe tactics.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly recommends DM-on-reply lead-magnet tactics as a default growth strategy without any guardrails around privacy, consent, retention, or platform-policy compliance. That can encourage collection of user identifiers and message-based outreach in ways that expose personal data, create spam/compliance risk, and normalize manipulative engagement flows.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill recommends screenshots of DMs, emails, and tweets as engagement assets but provides no warning about consent, redaction, or sensitive-data exposure. In practice this can lead users to publish private communications, personal identifiers, account details, or confidential business information, causing privacy breaches and reputational or legal harm.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.