Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says: it converts a user-provided local Twitter/X bookmarks export into local Markdown files, with no evidence of hidden network access, credential theft, persistence, or destructive behavior.
Install only if you are comfortable creating a local archive of your Twitter/X bookmarks. Store bookmarks.json and the generated output in a private folder, avoid committing or syncing them unintentionally, and delete the raw captured JSON when you no longer need it.
The README instructs users to export their entire private X/Twitter bookmarks dataset into local files, but provides no warning that bookmarks may contain sensitive personal interests, private research topics, or other confidential material. This is a real security/privacy issue because users may unknowingly create an unencrypted, easily copied local archive of private content and metadata.
The skill performs file read/write operations but does not declare any explicit tool scope or permission boundaries. That omission can cause an agent or user to execute the skill with broader filesystem access than intended, increasing the chance of unintended reads, overwrites, or misuse if the implementation is modified or invoked in a permissive environment.
The skill instructs users to export and persist bookmark data locally without warning that bookmarks may contain sensitive personal interests, account metadata, URLs, and engagement details. Users may unknowingly create a durable, searchable local archive of private content, which raises privacy and data-handling risk on shared or synced systems.
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
4. Saves files to `output/bookmarks/` folder, named sequentially like `0001-title.md`.
5. Extracts full content for all tweet types:
- **Regular tweets** — full text, t.co URLs expanded to real URLs
- **Note tweets** — complete long-form text (no truncation)
- **X Articles** — title + preview text + article link
6. Includes quoted tweets as blockquotes, media image/video links, and engagement stats.
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
4. Saves files to `output/bookmarks/` folder, named sequentially like `0001-title.md`.
5. Extracts full content for all tweet types:
- **Regular tweets** — full text, t.co URLs expanded to real URLs
- **Note tweets** — complete long-form text (no truncation)
- **X Articles** — title + preview text + article link
6. Includes quoted tweets as blockquotes, media image/video links, and engagement stats.
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
4. Saves files to `output/bookmarks/` folder, named sequentially like `0001-title.md`.
5. Extracts full content for all tweet types:
- **Regular tweets** — full text, t.co URLs expanded to real URLs
- **Note tweets** — complete long-form text (no truncation)
- **X Articles** — title + preview text + article link
6. Includes quoted tweets as blockquotes, media image/video links, and engagement stats.