X Twitter Post Publisher

• Outcome: Review
• Latest audit: May 29, 2026 at 9:38 PM UTC
• Version:
  1.0.0

Overview

This skill is meant to publish X/Twitter posts, but it can post publicly from a logged-in account and points to a missing PowerShell script.

Review before installing. Only use this with an explicit rule that the agent must show the exact post text, selected markdown label, and active X/Twitter account, then receive clear approval before clicking Post. Also verify or replace the missing publish-x-post.ps1 script before running any PowerShell command.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill automates an irreversible external action—posting to a public social media account—without requiring an explicit confirmation step immediately before submission. In an agent setting, this increases the risk of accidental, premature, or context-confused posting from the user's authenticated account, which can cause reputational harm and unintended disclosure.

VirusTotal

63/63 vendors flagged this skill as clean.