Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed X post collection workflow that uses Gecho’s MCP and Chrome extension, with notable but purpose-aligned setup and data-saving risks.
Install only if you are comfortable using Gecho Bridge and its Chrome extension with your logged-in X session. Prefer reviewing or pinning the Gecho Bridge package version instead of using @latest, and save results only to a directory where raw collected X data is appropriate to store.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Join the [WeCom group](https://github.com/gecho-ai/gecho-bridge/blob/main/qywx.jpg) or use the [1:1 support QR code](https://github.com/gecho-ai/gecho-bridge/blob/main/wx.jpg).
## Output guidelines
For success:
- Say the tool completed.
The skill instructs users to launch an MCP server via npx ...@latest, which fetches and executes the newest package version at runtime without pinning or integrity controls. That creates a supply-chain risk: a compromised upstream package or malicious update could gain code execution in the local environment where the MCP server runs.
The skill states that it may save structured and raw X data and later allows a user-provided save_dir, but it does not prominently warn that local files will be written or that raw results may contain more data than the chat summary. This can lead to unintended local persistence of scraped content in sensitive directories or shared workspaces.
No suspicious patterns detected.