Security audit
Security checks for vulnerabilities and agentic risk
This skill fetches public X/Twitter posts through the disclosed FxTwitter service and does not show hidden persistence, credential access, or unrelated behavior.
Install only if you are comfortable with requested public tweet identifiers being sent to FxTwitter. Avoid using it for sensitive research workflows where even the fact that you queried a specific post should remain private.
The README states the tool works without login or API keys but does not clearly disclose that tweet URLs and requested content are sent to the external FxTwitter public API. This can mislead users into assuming requests are made directly to X, creating a privacy and data-handling risk because queried URLs, article content, and associated metadata are exposed to a third party.
The skill explicitly performs network access to a third-party service but does not declare any tool scope or permission boundary in the skill metadata. This can cause users or hosting agents to underestimate the skill's external communication behavior, weakening informed consent and policy enforcement around network-capable skills.
The skill states it fetches tweets without login or API keys, but the description does not clearly warn that user-supplied tweet URLs and resulting content are transmitted through FxTwitter, a third-party proxy. This creates a privacy and trust risk because users may assume direct retrieval from X/Twitter or local-only processing when in fact their queries and accessed content are exposed to an external service.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
username, tweet_id = parse_tweet_url(url)
result = {"url": url, "username": username, "tweet_id": tweet_id}
api_url = f"https://api.fxtwitter.com/{username}/status/{tweet_id}"
try:
req = urllib.request.Request(api_url, headers={"User-Agent": "Mozilla/5.0"})
with urllib.request.urlopen(req, timeout=15) as resp:
No suspicious patterns detected.