Security audit

Twitter Search

Security checks across malware telemetry and agentic risk

Overview

The skill does the advertised Twitter/X search work, but its wrapper reads and evaluates shell profile content and may install a Python package during normal use.

Review before installing. Safer use would be to avoid the wrapper as written, install dependencies yourself in a controlled environment, pass `TWITTER_API_KEY` through the process environment or direct Python script, and remove the `eval`-based shell-profile parsing.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill clearly requires environment access and outbound network access, yet those capabilities are not explicitly declared. This weakens user consent and platform policy enforcement because the skill can read local configuration and send user queries plus API credentials to an external service without a clear permission boundary.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented behavior materially differs from the stated purpose: it reads shell config files for secrets, may install dependencies, and relies on a third-party API while presenting itself as a generic Twitter search/reporting skill. That mismatch can mislead users into granting trust or invocation in situations where they would not consent to local file access, package installation, or third-party data transmission.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The script reads shell startup files and uses eval on content extracted from them to recover TWITTER_API_KEY. This expands the skill's access to sensitive local configuration and creates command-execution risk if those files contain unexpected or attacker-influenced content matching the grep pattern.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Installing Python packages at runtime is outside the core Twitter-search function and executes additional code from package infrastructure on the user's machine. This increases supply-chain exposure, can modify the environment unexpectedly, and may violate least-privilege expectations for a wrapper script.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: An overly broad invocation description increases the chance the skill is triggered for generic social-media tasks outside the user's intended scope. In context, that matters because invocation can lead to external network calls and potential handling of API credentials, so over-selection raises privacy and consent risks.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill does not clearly warn users that their supplied queries will be transmitted to a third-party service and that external social-media data will be fetched via twitterapi.io. Lack of disclosure creates privacy and consent risk, especially when user-entered search terms may contain sensitive business, investigative, or personal topics.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script silently inspects ~/.bashrc and ~/.zshrc to extract an API credential before clearly obtaining consent. Even though it targets a Twitter key, accessing shell config files is sensitive behavior and broadens trust assumptions beyond the stated search task.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.