X (Twitter) Publisher

• Outcome: Pass
• Latest audit: Jul 27, 2026 · 1:49 PM UTC
• Version: 1.2.1

Overview

This skill is a disclosed X posting tool that uses user-provided X API credentials to publish tweets, media, replies, and threads.

Install only if you are comfortable giving the skill X API credentials with write access. Use a dedicated or test X app/account where possible, keep credentials out of source control, review generated text and media before invoking the publish commands, and consider pinning Tweepy or using a locked environment for production use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill declares sensitive environment-variable dependencies but does not explicitly declare permissions/capabilities beyond metadata, which weakens transparency and reviewability. In an agent ecosystem, this can cause users or policy engines to underestimate the skill's access to secrets and external publishing capability.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The public description understates behavior by omitting thread posting, account/profile retrieval during verification, and proxy-based network routing. Behavior-description mismatches are dangerous because they impair informed consent and can hide broader data access or publication actions than a user expects.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The reference material documents tweet creation and deletion as normal operations but does not warn that these actions can publish irreversible public content or remove content from a live account. In a skill explicitly designed to post to X on a user's behalf, this omission increases the risk that an agent or user invokes destructive or reputation-affecting actions without adequate confirmation or guardrails.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The tool performs a real external side effect by publishing content to X, but it does not present an explicit confirmation or warning immediately before transmission that the tweet text and attached media will be sent to a third-party service and become public. In an agent-skill context, this increases the risk of unintended disclosure, because user-provided or model-generated content could be posted without a clear final consent checkpoint.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: X (Twitter) Publisher
description: Publish tweets to X (Twitter) using the official Tweepy library. Supports text-only tweets, tweets with images or videos, and returns detailed publish results including tweet ID and URL. Requires X API credentials (API Key, API Secret, Access Token, Access Token Secret).
env:
  - X_API_KEY
  - X_API_SECRET

• Confidence: 95% confidence
• Finding: The duplicated finding reflects the same underlying issue: the skill depends on sensitive X access tokens and secrets. Access to these credentials permits authenticated posting and account interaction, so any misuse, exfiltration, or accidental disclosure could directly compromise the associated X account.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: X (Twitter) Publisher
description: Publish tweets to X (Twitter) using the official Tweepy library. Supports text-only tweets, tweets with images or videos, and returns detailed publish results including tweet ID and URL. Requires X API credentials (API Key, API Secret, Access Token, Access Token Secret).
env:
  - X_API_KEY
  - X_API_SECRET

• Confidence: 95% confidence
• Finding: The duplicated finding reflects the same underlying issue: the skill depends on sensitive X access tokens and secrets. Access to these credentials permits authenticated posting and account interaction, so any misuse, exfiltration, or accidental disclosure could directly compromise the associated X account.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

tweepy>=4.14

• Confidence: 94% confidence
• Finding: The dependency is specified as `tweepy>=4.14` without an upper bound or exact pin, so installs may pull in newer releases than the author tested. This creates supply-chain and stability risk: a future compromised, vulnerable, or breaking Tweepy release could be installed automatically in a skill that handles X API credentials and publishes on behalf of the user.

Static analysis

No suspicious patterns detected.