opentwitter

• Outcome: Review
• Latest audit: Oct 12, 2026 · 4:29 AM UTC
• Version: 1.0.2

Overview

This is mostly a documented Twitter/X data client, but it also supports deleted-content retrieval and persistent account monitoring that users should review carefully.

Install only if you trust the 6551/OpenNews service with your bearer token and the Twitter/X accounts, searches, tweet IDs, and monitoring lists you submit. Treat deleted-tweet, follower-event, watchlist, and WebSocket features as sensitive monitoring tools, and remove watched accounts when monitoring is no longer needed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description presents the skill as a simple Twitter/X and meme data query tool, but the body also exposes watchlist management, follower/unfollower monitoring, deleted tweet retrieval, and real-time streaming of monitored account activity. This capability mismatch can mislead users and reviewers about the actual behavioral scope, reducing informed consent and making the monitoring features more likely to be enabled without scrutiny.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

env:
        - OPENNEWS_TOKEN
      bins:
        - curl
    primaryEnv: OPENNEWS_TOKEN
    emoji: "\U0001F426"
    install:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

Search with query:

bash

curl -s -X POST "https://ai.6551.io/open/twitter_search" \
  -H "Authorization: Bearer $OPENNEWS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "from:VitalikButerin bitcoin -filter:replies", "maxResults": 20, "product": "Top"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 76% confidence

Finding

This endpoint transmits account identifiers to a third-party service to obtain follower and unfollower monitoring data, which is more privacy-sensitive than ordinary content lookup. In context, the risk is not the network request itself but the undocumented surveillance-like nature of the data collection and the lack of user warning around it.

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

bash

# Get new followers
curl -s -X POST "https://ai.6551.io/open/twitter_follower_events" \
  -H "Authorization: Bearer $OPENNEWS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"username": "elonmusk", "isFollow": true, "maxResults": 20}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill documents retrieval of deleted tweets and follower-event monitoring without any privacy, consent, or acceptable-use warning. Even if the backend service technically permits these queries, presenting them as routine operations without safeguards can normalize collection of sensitive behavioral data and expose users to policy or compliance violations.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 81% confidence

Finding

This request obtains deleted tweets from a third-party service, which can involve sensitive or intentionally removed content. While the transmission itself is expected for the feature, the feature materially raises privacy and misuse concerns and is not accompanied by warnings or constraints in the documentation.

Content

Scanner excerpt · SKILL.md (reported line 204)May include surrounding context.

Get deleted tweets from a user.

bash

curl -s -X POST "https://ai.6551.io/open/twitter_deleted_tweets" \
  -H "Authorization: Bearer $OPENNEWS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"username": "elonmusk", "maxResults": 20}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

Get which KOLs (Key Opinion Leaders) are following a user.

bash

curl -s -X POST "https://ai.6551.io/open/twitter_kol_followers" \
  -H "Authorization: Bearer $OPENNEWS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"username": "elonmusk"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 235)May include surrounding context.

Get Twitter article by ID.

bash

curl -s -X POST "https://ai.6551.io/open/twitter_article_by_id" \
  -H "Authorization: Bearer $OPENNEWS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"id": "article_id"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

This endpoint retrieves a tweet by ID and automatically fetches any tweets it replies to or quotes, providing complete context.

bash

curl -s -X POST "https://ai.6551.io/open/twitter_tweet_by_id" \
  -H "Authorization: Bearer $OPENNEWS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"twId": "2030318958512164966"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.

Get tweets that quote a specific tweet.

bash

curl -s -X POST "https://ai.6551.io/open/twitter_quote_tweets_by_id" \
  -H "Authorization: Bearer $OPENNEWS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"id": "2030318958512164966", "maxResults": 20}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 288)May include surrounding context.

Get users who retweeted a specific tweet.

bash

curl -s -X POST "https://ai.6551.io/open/twitter_retweet_users_by_id" \
  -H "Authorization: Bearer $OPENNEWS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"id": "2030318958512164966"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The watch-list and websocket subscription features create ongoing monitoring and real-time streaming of account activity, but the skill does not clearly warn that this is persistent surveillance behavior rather than one-off lookup. That omission increases the chance of covert or uninformed use, especially because the manifest description understates these capabilities.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 78% confidence

Finding

This endpoint retrieves the current user's Twitter monitoring watchlist from the provider, tying the skill to persistent surveillance/account-tracking functionality. In context, the danger comes from the under-disclosed monitoring behavior and absence of privacy warnings, not merely from making an HTTP request.

Content

Scanner excerpt · SKILL.md (reported line 304)May include surrounding context.

Get all Twitter monitoring users for the current user.

bash

curl -s -X POST "https://ai.6551.io/open/twitter_watch" \
  -H "Authorization: Bearer $OPENNEWS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 344)May include surrounding context.

Delete a Twitter user from monitoring list by username.

bash

curl -s -X POST "https://ai.6551.io/open/twitter_watch_delete" \
  -H "Authorization: Bearer $OPENNEWS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"username": "elonmusk"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 552)May include surrounding context.

Crypto Twitter KOL Tweets

bash

curl -s -X POST "https://ai.6551.io/open/twitter_user_tweets" \
  -H "Authorization: Bearer $OPENNEWS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"username": "VitalikButerin", "maxResults": 10}'

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The skill declares a required environment secret OPENNEWS_TOKEN and instructs callers to use it for all requests. While network access is expected for a Twitter data skill, handling external bearer credentials is a broader capability than the manifest description itself states, which only describes data types and endpoints rather than credentialed access requirements.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.