Twitter To Binance Square

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:32 AM UTC
• Version: 0.1.0

Overview

This skill is mostly coherent, but it can automatically publish to your Binance Square account and its default safeguards are not strong enough for that authority.

Review before installing. Run in dry-run mode first, disable show_tool_attribution unless you explicitly want that text in every post, avoid inline credentials in cron or shell history, and use dedicated least-privilege keys. Do not run it as a background or scheduled job until you are comfortable with the exact accounts, search terms, posting limits, and transformed output it will publish.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/auto_mirror.py:211

Finding

Default Promotional Content Injection into Mirrored Posts

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auto_mirror.py:391

Finding

Documented First-Post Approval Control Is Not Implemented

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:114

Finding

API Credentials Encouraged in Persistent Cron Command

Content

View full analysis

> mirror.log 2>&1 ``` ### Technical Analysis The documented cron example encourages users to place both API credentials directly in a crontab command. If users replace the placeholders with real values, the credentials become persistent plaintext data inside the crontab. Depending on operating-system configuration and operational practices, crontab contents may be exposed through administrative tooling, support bundles, backups, configuration-management systems, or other users with sufficient local access. Command-line environment assignments may also be visible through process inspection on some systems. Although the script itself reads credentials from environment variables and does not log them, the recommended method of populating those variables weakens secret handling. ### Attack Path 1. A user copies the documented cron entry. 2. The user replaces `xxx` with real Twitter and Binance Square API credentials. 3. The full credentials are stored persistently in the crontab and potentially replicated into backups or management systems. 4. An attacker or unauthorized local operator obtains read access to the crontab, backup, diagnostic output, or process metadata. 5. The attacker recovers the credentials. 6. The Twitter token can be used according to its API permissions, while the Square key can be used to submit unauthorized posts within the key's granted scope and platform limits. ### Impact Assessment Exposure of `TWITTER_TOKEN` permits unauthorized consumption of the associated 6551 API entitlement. Exposure of `SQUARE_API_KEY` can permit unauthorized posting to the user's Binance Square account. The exact im ...[truncated 257 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'file_write' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The markdown states that tweets are automatically collected, transformed, and posted to Binance Square, which implies network transmission of third-party content and account-linked publishing. While the file gives setup and usage steps, it does not explicitly warn users about privacy, account-impact, or external data transfer risks beyond operational notes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The README instructs users to place API tokens in environment variables and even inline them in cron examples, but does not warn about secure handling, shell history exposure, process/environment leakage, file permission hygiene, or log leakage. In an automation skill that uses long-lived credentials for two external platforms, weak credential-handling guidance materially increases the risk of token compromise and account misuse.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 102)May include surrounding context.

Linux/Mac:

bash

nohup python scripts/auto_mirror.py --config mirror_config.json > mirror.log 2>&1 &

Windows (PowerShell):

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The auto-run trigger phrases are broad and overlap with natural user requests like 'auto post from twitter' or 'start twitter mirror,' which can cause the skill to activate in situations where the user did not intend to initiate external posting automation. Because the skill can eventually perform continuous external transmissions to third-party services, ambiguous invocation increases the risk of accidental activation and unintended posting behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest says the skill auto-mirrors Twitter/X content to Binance Square, which explains network access conceptually, but this file specifically operationalizes the behavior through shell execution examples and an allowed Bash tool. For an AI agent skill, spawning shell commands is a broader capability than necessary to describe or implement the business intent, and the manifest does not justify why command execution is needed rather than a narrower integration path.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

Option A: Monitor Specific Account

bash

curl -s -X POST "https://ai.6551.io/open/twitter_user_tweets" \
  -H "Authorization: Bearer $TWITTER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The configuration defaults impose a target language of Chinese (translate_to: "zh") without clear per-user opt-in, which can silently transform user content or mirrored content into a different language than intended. In an automation context, silent defaults can lead to inaccurate or misleading published posts, especially when content is translated and reposted externally.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 55% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/auto_mirror.py (reported line 281)May include surrounding context.

python

# ---------------------------------------------------------------------------

def load_state(path: str) -> dict:
    """Load persisted state from disk."""
    p = Path(path)
    if p.exists():
        try:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/auto_mirror.py (reported line 298)May include surrounding context.

python

def save_state(state: dict, path: str):
    """Persist state to disk."""
    Path(path).write_text(json.dumps(state, indent=2, ensure_ascii=False), encoding="utf-8")

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The parameter description specifies --translate-to with a default of zh, which indicates a built-in locale preference in the skill's natural-language behavior. The README does not frame this as an opt-in or justify the locale restriction as region-specific, so it can conflict with language-choice policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The default configuration sets translate_to to zh, which hard-codes a specific locale preference in the skill's natural-language behavior. This can violate language/locale policy expectations when users have not explicitly chosen that language target.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script exposes translation-related options and configuration (--translate, --translate-to, and corresponding defaults), implying tweet content may be translated before posting. However, no code path uses these settings during transform_tweet or posting, so the documented/declared behavior contradicts actual execution.

Content

No source excerpt is available for this finding.