Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed X search workflow using Gecho Bridge, with normal setup and session-use risks but no evidence of hidden or malicious behavior.
Install only if you are comfortable connecting Gecho Bridge and its Chrome extension to a logged-in X session for public post research. Review the Gecho Bridge package/source before running the npx @latest setup command, and prefer a pinned version if your environment requires reproducible or reviewed dependencies.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Join the [WeCom group](https://github.com/gecho-ai/gecho-bridge/blob/main/qywx.jpg) or use the [1:1 support QR code](https://github.com/gecho-ai/gecho-bridge/blob/main/wx.jpg).
## Output guidelines
For success:
- Say the tool completed.
The skill instructs users to install and run an MCP server via npx ...@latest, which pulls and executes the newest published package without pinning a reviewed version. That creates a software supply-chain risk: a compromised upstream package, malicious publish, or breaking update could lead to arbitrary code execution in the user's environment when they follow the setup steps.
The invocation guidance is broad enough that an agent may activate this skill whenever a user asks about X/Twitter research, structured results, saving data, or platform research, without tighter constraints on when not to use it. In an agentic environment, that can cause over-triggering of a browser-connected scraping workflow, leading to unnecessary external actions, privacy exposure, or use of a logged-in session when the user did not explicitly intend that level of access.
No suspicious patterns detected.