X Deep Miner

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:53 PM UTC
• Version: 1.2.0

Overview

This skill is an underimplemented X-to-Obsidian scaffold that asks users to set up persistent hourly execution without enough scoping or removal guidance.

Review this before installing if you are comfortable with a Chinese-language, mostly unfinished scaffold. Do not add the suggested cron job unless you want persistent hourly execution, use absolute paths, restrict permissions on the project directory, and document how to remove the crontab entry later.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Warning

• Location: SKILL.md:25

Finding

Persistent Hourly Execution Through User Crontab

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description overstates the implemented functionality. While the code structure aligns with the general theme of an X/Twitter mining-to-Obsidian workflow, the core capabilities are not actually implemented: tweet collection is only described in comments/prints, no real browser or API calls occur, no automatic hourly scheduling exists, and translation is not performed. The Obsidian note generation and local file output do match part of the declaration, but the primary promised behavior is only a scaffold rather than a functioning auto-scanning/translation pipeline.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill advertises operational behavior and references executable scripts, but the manifest declares no explicit tool scope or permissions despite detected capabilities for environment access and file read/write. This creates an overbroad and non-transparent trust boundary: operators cannot easily tell what resources the skill may use, which increases the chance of unintended data access or modification when the skill is installed or reviewed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says the skill will automatically translate content into professional Chinese articles, which imposes a specific language choice by default. Under the language/locale policy, this is a natural-language policy concern unless the skill explicitly offers user choice or documents a justified locale constraint.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The skill documentation explicitly instructs users to install a cron job for recurring execution, which introduces persistence on the host outside the normal interactive session. In security-sensitive environments, unattended periodic execution can repeatedly access files, environment variables, network resources, or generate content without ongoing user review, increasing the blast radius if the underlying script is later modified or behaves unexpectedly.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

python3 scripts/x_deep_miner.py status

设置定时任务

crontab -e 0 * * * * cd /path/to && python3 scripts/x_deep_miner.py scan

text

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes an operational skill that automatically scans high-heat X posts every hour, translates them into professional Chinese articles, and outputs Obsidian format. In contrast, this documentation explicitly says auto-crawling and translation still require manual steps or future API integration, and calls the hourly scan 'currently simulated,' indicating the implemented behavior does not match the advertised capability.

Content

No source excerpt is available for this finding.

Tainted flow: 'CONFIG_FILE' from os.environ.get (line 20, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/x_deep_miner.py (reported line 54)May include surrounding context.

python

def save_config(config: dict):
    """保存配置"""
    CONFIG_FILE.parent.mkdir(parents=True, exist_ok=True)
    with open(CONFIG_FILE, 'w') as f:
        json.dump(config, f, indent=2)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation says the function '抓取用户 Timeline 新帖' using a managed browser, which describes an implemented scraping action. In reality, the body performs no browser interaction or tweet extraction and always returns an empty list, so the inline intent directly contradicts the actual behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The docstring states that the function translates text into professional Chinese while preserving technical terms. The implementation is a placeholder that returns the original text without any translation, which is a direct contradiction rather than merely incomplete documentation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The function docstring explicitly says content will be translated into Chinese, and the rest of the user-facing output is also Chinese. This enforces a specific language/locale without any opt-in, fallback, or documented regional justification, which matches the natural-language policy violation criteria.

Content

No source excerpt is available for this finding.

Tainted flow: 'output_path' from os.environ.get (line 168, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/x_deep_miner.py (reported line 169)May include surrounding context.

python

filename = f"{datetime.now().strftime('%Y%m%d_%H%M%S')}_{safe_title}.md"
    
    output_path = OUTPUT_DIR / category / filename
    with open(output_path, 'w', encoding='utf-8') as f:
        f.write(note)
    
    print(f"  ✓ 已保存: {output_path}")

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file contains user-facing instructions exclusively in Chinese, and there is no note that the skill is region-specific or that alternative languages are supported. Per the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.