Security audit

xfetch

Security checks for vulnerabilities and agentic risk

Overview

This skill can run an X/Twitter scraping CLI with access to browser cookies and private account data, but it does not clearly scope consent, credential handling, or the exact executable being reviewed.

Review this carefully before installing. Use it only if you are comfortable giving the CLI access to your authenticated X/Twitter session, including private areas like DMs, bookmarks, notifications, and timelines. Prefer a pinned, audited version, avoid pasting live session tokens into command lines or chat, and require explicit confirmation before any browser cookie extraction or private-account export.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:9
Finding: Execution of an Unpinned Third-Party CLI Package
Content: View full analysis
Remediation: View remediation
``` 2. Verify package integrity using a lockfile and registry integrity digest. 3. Vendor or include the security-relevant source so reviewers can validate credential storage, network destinations, and browser access. 4. Do not silently fall back from a locally verified executable to a dynamically downloaded package. 5. Run the CLI in a constrained environment with only the filesystem and browser-profile access required for the requested operation. 6. Establish a package update process that requires review before changing the pinned version or integrity value. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:20
Finding: Broad Browser Cookie Extraction for X/Twitter Authentication
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:28
Finding: X/Twitter Session Tokens Accepted Through Command-Line Arguments
Content: View full analysis
--ct0 ``` The same pattern is repeated at `SKILL.md:128`: ```bash xfetch auth set --auth-token --ct0 # set tokens manually ``` The global options at `SKILL.md:169-170` also allow credentials to be supplied as arguments: ```markdown | `--auth-token ` | Override auth_token cookie | | `--ct0 ` | Override ct0 cookie | ``` ### Technical Analysis The `auth_token` cookie represents an authenticated X/Twitter session, while `ct0` is associated with authenticated request validation. Supplying these values directly on a command line can expose them outside the intended process. Depending on the operating system, shell, Agent framework, and logging configuration, command-line secrets may be visible through: - Shell history files. - Process inspection utilities. - Agent execution transcripts and debugging logs. - Terminal recording or command auditing. - Monitoring and telemetry systems that capture process arguments. - Error reports that reproduce invoked commands. Sending these tokens to X/Twitter is necessary for authenticated requests and does not, by itself, demonstrate malicious network exfiltration. The vulnerability is the plaintext command-line transport and unspecified local storage behavior, not the legitimate use of the tokens for X authentication. ### Attack Path 1. The user or Agent invokes `xfetch auth set` with live session credentials in the command line. 2. The shell, Agent framework, operating system, or monitoring system records or exposes the process arguments. 3. A local user, support operator, log reader, or attacker with access to those records retrieves the token values. 4. The attacker supplies the stolen cookies to an X/Twitter client or com ...[truncated 721 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description uses very broad activation language like 'use this skill whenever you need to retrieve any data from X/Twitter' and includes highly sensitive scopes such as DMs, notifications, bookmarks, and exported account data. Overbroad invocation increases the chance an agent will select this skill automatically in contexts where the user did not clearly consent to accessing private or authenticated Twitter data.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill documents cookie extraction from local browsers and access to private Twitter surfaces such as DMs, home timeline, bookmarks, and notifications, but provides no warnings about the sensitivity of browser cookies or the privacy implications of authenticated scraping. In this context, omission of consent and safety warnings is especially dangerous because cookies can grant full account access and expose private user data beyond the immediate request.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The documentation recommends running the package via npx @lxgic/xfetch / bunx @lxgic/xfetch without pinning a specific version. That causes execution of whatever package version is current at runtime, creating a supply-chain risk where a compromised or malicious new release could be fetched and executed immediately.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.