Security audit

X Search Highlights

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it advertises, but it needs review because unsafe browser automation could run injected JavaScript inside a logged-in X session.

Review before installing. Use a dedicated low-privilege browser profile for X, avoid running it on attacker-supplied search strings or unusual numeric parameters, and prefer a version that JSON-encodes text inputs, validates numeric bounds, and clearly documents account/session risks.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/x-search.sh:36
Finding: User-Controlled JavaScript Injection in an Authenticated Browser Context
Content: View full analysis
Remediation: View remediation
&2; exit 1 ;; esac case "$MIN_LIKES" in ''|*[!0-9]*) echo "Invalid minLikes" >&2; exit 1 ;; esac case "$SCROLL_TIMES" in ''|*[!0-9]*) echo "Invalid scrollTimes" >&2; exit 1 ;; esac ``` 4. **Enforce reasonable bounds** to prevent excessive browser activity or resource consumption, such as: - `MAX_RESULTS`: 1–100 - `MIN_LIKES`: 0–1,000,000,000 - `SCROLL_TIMES`: 0–20 5. **Prefer structured browser-evaluation arguments.** If `bb-browser` supports passing JSON arguments separately from source code, use that facility. The evaluated program should retrieve values from the structured argument object rather than from generated source. 6. **Add security regression tests** covering topics and arguments containing: - Single and double quotes - Backslashes - Newlines and Unicode line separators - Semicolons and parentheses - Template-literal characters - JavaScript comments - Non-numeric values and values outside permitted bounds 7. **Use proper URL encoding** for the search topic rather than replacing only spaces. A standard percent-encoder prevents the topic from changing query parameters or URL structure. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented default markdown output uses Chinese labels such as 标题, 日期, 标签, 亮点, and 互动, but the skill description does not indicate this is optional or user-selected. This can violate language/locale policy by imposing a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This shell script emits multiple fixed Chinese strings such as '搜索结果', '日期', '内容摘要', and the completion message, which imposes a specific language on users regardless of their preferences. That matches the policy violation category for locale/language constraints because the file does not offer any opt-in, configuration, or justification for the language choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill depends on an existing authenticated X.com browser session and performs scraping, but the user-facing description does not clearly warn about either prerequisite or behavior. This can mislead users into running browser automation against a personal logged-in account, creating privacy, consent, and account-risk concerns such as unintended access to personalized data or triggering platform enforcement.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.