Security audit

Ganidhuz-FoxX

Security checks across malware telemetry and agentic risk

Overview

This skill is meant to browse X/Twitter with a logged-in Firefox session, but it handles real session cookies and gives broad browser automation power that users should review carefully.

Install only if you intentionally want an agent to use your logged-in X/Twitter session. Use a dedicated Firefox profile and ideally a dedicated X account, inspect every plan before running it, avoid interactive actions unless you intend account changes, and delete or tightly protect exported cookies, storage-state files, screenshots, and the /tmp cookie database copy after each run.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documents environment-variable use plus file read/write operations for exporting cookies, loading them into Playwright, and optionally persisting session state, but it declares no permissions. That mismatch weakens review and consent because users are not clearly informed that authenticated browser secrets and local files are being accessed and written.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior substantially exceeds the stated purpose of browsing X/Twitter. By supporting arbitrary URLs, generic selectors, interactive actions, screenshots, content extraction, cookie export from Firefox, and storage-state persistence, the skill can automate authenticated actions or data access on sites beyond X, making the stated scope misleading and increasing abuse potential.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The supported actions include click, fill, type, and press, which enable posting, messaging, liking, following, changing settings, or other account operations despite the skill presenting itself as browse-oriented. In the context of injected real session cookies, those actions could perform authenticated state-changing operations as the user.

Intent-Code Divergence

Low

Confidence: 82% confidence
Finding: Although the browser is said to always close after the task, the documentation also allows writing session state to disk. Closing the browser does not eliminate risk if authenticated state is persisted in files that can later be reused, copied, or exposed.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script implements a generic browser automation engine that can navigate to arbitrary URLs and perform unrestricted actions like click, fill, type, press, screenshot, and content extraction based on an externally supplied plan. That exceeds the stated X/Twitter browsing purpose and creates a powerful general-purpose agent that could be repurposed for account actions, data harvesting, or interaction with unrelated sites using a logged-in browser context.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The code can export browser storage state to an arbitrary path, which may include authenticated session material and other sensitive browser state. In a skill described as read-oriented browsing via a logged-in session, undisclosed state export materially increases the risk of session theft, persistence, or reuse outside the intended workflow.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The setup instructs users to export live authenticated X/Twitter cookies from Firefox but does not prominently warn that these cookies are effectively bearer credentials. Anyone with access to the exported file may be able to impersonate the user’s session, especially when combined with generic browser automation.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The script extracts live X/Twitter authentication cookies from a real Firefox profile and writes them to a JSON file on disk. Those cookies are bearer credentials for the logged-in session, so any local user, process, backup system, or later compromise that can read the file may hijack the account without needing a password or MFA.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The script forcibly kills Firefox with pkill before copying the cookie database, which can terminate unrelated browsing sessions and cause data loss or user disruption. While this is more of a safety and usability problem than a direct security flaw, abruptly closing the browser without confirmation is risky behavior in a credential-handling script.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script automatically saves a validation screenshot and may also persist browser storage state without any user-facing disclosure or consent. Screenshots can capture private content, DMs, account data, or tokens visible in the session, and combined with state export this increases privacy and credential exposure risk.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.