Security audit

twitter-dance

Security checks across malware telemetry and agentic risk

Overview

This skill is not clearly malicious, but it gives scripts broad live control over an X/Twitter account and includes unsafe credential examples and secret-printing behavior, so it needs manual review before use.

Install only if you are comfortable giving this skill live control over an X/Twitter account through apidance.pro. Use a test or low-risk account first, rotate any credentials shown in the documentation, avoid running the scripts in shared terminals or CI logs, prefer --draft-only and --dry-run modes, and add your own confirmation gate before deletion, follow/unfollow, bulk engagement, auto-reply, or scheduled posting.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (51)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The document claims 'local processing, no upload' while elsewhere explicitly describing use of Twitter HTTPS/GraphQL/REST endpoints and notification retrieval. This is a misleading privacy/security claim that can cause users to underestimate what data is transmitted off-host, leading to uninformed consent and risky deployment decisions.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The guide labels the draft-only preview flow as "安全" (safe), but the same document instructs users to configure and handle sensitive credentials, including a hardcoded-looking Kimi API key example earlier in the file. This can create a false sense of safety and normalize unsafe secret handling in a workflow that still depends on external APIs and local secret exposure.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The README markets the skill as an automated tweet publishing system, but the documented API also supports liking, retweeting, searching tweets, and user lookup. This capability expansion increases the attack surface and enables broader account actions than a user would reasonably expect from the stated purpose, which is risky in an automation skill handling social-media credentials.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The '核心 API' section contradicts the claimed narrow purpose by normalizing broader Twitter interaction functions. In a credentialed automation context, such inconsistencies are security-relevant because they can mislead users about the true scope of account control the skill may exercise.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The guide embeds what appear to be live API credentials and explicitly instructs users to copy and use them. Exposing usable secrets in documentation enables immediate credential theft, account/API abuse, billing fraud, and takeover of connected social-media automation.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The JSON output includes the full API key, which is unnecessary for a quota-checking utility and can leak credentials into terminals, logs, CI artifacts, shell history, or downstream tooling that consumes stdout. Because --json is commonly used for automation, this materially increases the chance of accidental secret exposure beyond the local interactive display.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The script’s framing emphasizes fetching comments, but the actual behavior will post live replies unless --dry-run is supplied. That mismatch can cause operators to run a state-changing automation tool under the mistaken belief it is read-only, leading to unintended account activity and reputational or platform-policy consequences.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The script’s stated purpose is only to retrieve the user’s Twitter account information, but it also writes the full returned user object to a local JSON file. That creates an unnecessary persistence side effect for potentially sensitive profile/account metadata, increasing exposure through local disclosure, backups, or accidental commit of log files.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The script states it uses an 'official GraphQL API' but the comments and dependency indicate requests are sent via apidance.pro, a third-party intermediary. This is dangerous because it can mislead operators into disclosing Twitter auth tokens to an external service under false assumptions about trust boundaries and data handling.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The example output interpolates process.env.TWITTER_AUTH_TOKEN and process.env.APIDANCE_API_KEY directly into console output, which can expose live secrets to terminal logs, CI logs, screenshots, or shell history capture. Because it is framed as reference text, users may not realize the script is revealing real credentials during normal execution.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The client exposes follow/unfollow operations that can directly manipulate a user's Twitter account state via a third-party API service. While these may be legitimate features for a social media automation client, they expand the skill from passive access into account-manipulation actions that can be abused for spam, unwanted social graph changes, or covert account activity if invoked without explicit user intent.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill can enumerate followers and following lists, enabling collection of a user's social graph through the external API. Even if intended for account management, this creates privacy and data-harvesting risk because bulk relationship data can be exfiltrated or repurposed without strong user awareness or need-to-know controls.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The client supports tweet deletion, which is a destructive account action not highlighted in the stated purpose. In an agent setting, exposing deletion as a normal callable primitive increases the risk of unauthorized or mistaken content removal, account damage, and loss of auditability if the skill is invoked by prompts or automation chains.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The script loads API credentials from environment variables and automatically sends authenticated requests to a third-party service, including a state-changing endpoint (`/v1.1/statuses/update.json?status=test`). Even if intended as endpoint testing, this can cause unauthorized or unintended actions on a linked social-media account and performs credentialed external network activity without clear justification or safeguards.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The document instructs use of authentication headers and account-scoped endpoints, but provides no warning about safe handling of tokens, privacy implications, or storage/logging risks. In a skill context, this can normalize unsafe credential usage and lead operators to expose auth secrets in scripts, logs, screenshots, or shared configs.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The method list includes state-changing operations such as tweet, like, retweet, follow, and unfollow, but the document does not warn that these actions modify a user's account or may have irreversible/public side effects. In an agent skill, omission of such warnings increases the chance of unintended actions being triggered automatically or without adequate confirmation.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The guide prominently presents commands that will perform real public reply posting with only a brief distinction between dry-run and live mode, but it does not sufficiently warn about accidental live execution, reputational harm, spam/policy violations, or privacy implications of automated engagement. In a skill that automates posting to a real social-media account, missing safety guidance materially increases the chance of unintended account-impacting actions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation instructs users to place sensitive credentials in environment variables and obtain them from browser and external bot sources, but it omits basic secret-handling warnings such as not sharing tokens, not committing .env files, and rotating compromised credentials. Because these credentials can grant direct access to a Twitter account or related services, unsafe handling can lead to account takeover or abuse.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: This changelog includes runnable commands that publish tweets to a live external service, but it does not clearly warn users that executing them can create real public posts and transmit data over the network. In an agent/skill context, users may treat examples and test commands as safe diagnostics, which increases the risk of accidental posting, reputational harm, or unintended disclosure.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The recommended usage section presents API calls and CLI commands as normal examples without a prominent notice that they perform real network actions and may publish visible content to Twitter/X. Because these examples are framed as recommended workflows, they are especially likely to be copied verbatim, creating a realistic risk of accidental external side effects.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The documentation explicitly instructs users to run `cat .../.env`, which prints all environment variables, likely including API keys and auth tokens, directly to the terminal. This is dangerous because secrets may be exposed to shell history capture, screen sharing, terminal logs, or copied into tickets/chats during troubleshooting.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: This section documents live account-modifying actions such as liking, retweeting, replying, deleting tweets, following, and unfollowing without any prominent warning, dry-run default, or confirmation guidance. In a skill intended for automation, omission of safeguards increases the risk of accidental destructive or reputationally harmful actions against a real social-media account.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation explicitly instructs users to schedule unattended automatic posting via cron/OpenClaw, but does not prominently warn about the risks of live autonomous posting, including spam, policy violations, unwanted content generation, or account suspension. Because this skill posts to a real Twitter/X account using stored credentials, unattended execution materially raises operational and abuse risk.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The guide provides a cron example that will automatically post to a public social-media account on a schedule, but it does not clearly warn users that this causes repeated public publication under their credentials. In an agent/skill context, scheduled autonomous posting can amplify mistakes, spam, reputational harm, or unauthorized use if the content source or environment is compromised.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation promotes fully automated and bulk Twitter posting, including cron-based unattended execution and repeated posting workflows, without clear warnings about accidental public posting, account lock/suspension risk, or platform policy violations. In the context of a social-media automation skill, this omission materially increases the chance of harmful misuse or operational mistakes, even though it is presented as a feature rather than an explicitly malicious capability.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.