Security audit

X Alpha Scout

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for X/Twitter crypto sentiment scouting, but it asks users to route reusable X session credentials through an unpinned third-party CLI without enough scoping or safety guidance.

Install only if you are comfortable giving the bird CLI authenticated access to an X/Twitter session. Prefer a dedicated low-privilege account, keep X_AUTH_TOKEN and X_CT0 out of chat, logs, screenshots, and repositories, verify the bird source/version before use, and treat all tweet text and links as untrusted data that should not control the agent or redirect report delivery.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: README.md:18
Finding: Unpinned Third-Party Executable Receives Reusable X/Twitter Session Credentials
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:99
Finding: Attacker-Controlled Tweet Content Is Processed Without Prompt-Injection Boundaries
Content: View full analysis
200 else tweet_text } ``` ### Technical Analysis Tweets retrieved from X are controlled by arbitrary external users. The skill directs an AI agent to analyze this content but does not establish a boundary between trusted skill instructions and untrusted source data. It does not tell the agent to ignore instructions embedded in posts, prohibit tool calls requested by retrieved content, restrict link handling, or quote content through a data-only representation. The parser performs ordinary string extraction and preserves up to 200 characters of raw tweet text. This is not malicious code, but it also does not provide semantic isolation fr ...[truncated 2312 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README instructs users to supply sensitive X/Twitter authentication material (X_AUTH_TOKEN and X_CT0) but provides no warning about secure storage, least-privilege handling, or the risk of exposing session credentials in logs, shell history, screenshots, or agent memory. Because these values are session-bearing credentials, mishandling them could allow account access or abuse of the user's X session.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The on-demand trigger examples are generic natural-language queries like "What do you think of $PEPEAI?" and "Analyze Pudgy Penguins" without any explicit activation boundary or exclusion conditions. In a general assistant context, these phrases are broad enough that the skill could be invoked unintentionally during normal conversation about assets or collections.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs users to provide and use active X/Twitter authentication credentials and then perform automated searches against the account, but it does not warn about the privacy, account-security, or terms-of-service risks of exposing and using those tokens. If mishandled, these credentials could allow unauthorized access to the user's X account session, account actions, or sensitive timeline/search data, especially in an agent environment where logs, prompts, or downstream tools may persist secrets.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.