X WebMCP

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:15 AM UTC
• Version: 1.0.1

Overview

This appears to be a real X/Grok bridge skill, but it can use a persistent signed-in X browser profile and is configured for implicit invocation, so account access and public posting need review before install.

Install only if you want the agent to operate a dedicated signed-in X profile. Keep the profile isolated, prefer a pinned or lockfile-managed Playwright install, and require explicit confirmation plus dry-run review before any tweet, reply, upload, or article publish action.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Playwright Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 16
Vulnerability Type: Unpinned third-party package retrieval and execution
Risk Level: Medium

Vulnerable Code

markdown

- On a fresh machine, or under an isolated `HOME`, install Playwright browsers first with `npx playwright install`.

Technical Analysis

The documented command invokes Playwright through npx without declaring a version, lockfile, integrity hash, trusted registry configuration, or requirement to use an already-installed local package.

If Playwright is not available in the local dependency tree, npx can resolve and download a package from the configured npm registry before executing its command. Consequently, the code executed by users may differ from the version reviewed when this skill was audited. Package resolution may also be influenced by registry configuration and the user's execution environment.

This creates a supply-chain trust boundary outside the reviewed project. Exploitation would require compromise or manipulation of the relevant package distribution path, such as a compromised upstream release, registry account, registry mirror, or package-resolution environment.

Attack Path

1. A user follows the prerequisite in SKILL.md on a fresh or isolated machine where Playwright is not locally installed.
2. The user runs npx playwright install.
3. npx resolves the unpinned playwright package through the configured npm registry or mirror.
4. A compromised or maliciously substituted package version is downloaded.
5. Package lifecycle behavior or the invoked package command executes attacker-controlled code with the privileges of the user running the command.
6. That code can access resources available to the user, potentially including project files, environment variables, network credentials, and browser-related data permitted by the host environment.

Impact Assessment

Successful exploitation would provide code execution under the ...[truncated 654 chars]

Remediation

View remediation

Remediation Suggestions

1. Add Playwright as an explicitly versioned project dependency and commit the corresponding package lockfile.

2. Install dependencies with a lockfile-enforcing command such as:

   bash

   npm ci
   

3. Invoke only the audited local dependency and prevent npx from downloading a missing package:

   bash

   npx --no-install playwright install
   

4. Alternatively, invoke the locked local executable directly:

   bash

   ./node_modules/.bin/playwright install
   

5. Pin the expected Node.js and Playwright versions in project documentation and continuous-integration checks.

6. Configure an approved npm registry and use lockfile integrity metadata. In higher-assurance environments, verify package provenance or signatures and mirror approved artifacts internally.

7. Update the prerequisite so it fails safely when the pinned local package is absent rather than retrieving and executing an arbitrary current registry version.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description covers a broader integration with both X and Grok, including use cases like reading timelines, posting tweets, and chatting with Grok through an authenticated browser profile. The supplied code does not implement those behaviors. It simply sanitizes certain CLI options and delegates to a bridge script with hardcoded X parameters. That means the observable behavior is limited to ensuring/linking an X site configuration, not connecting to Grok or a fixed UXC link, and not directly supporting the described user-facing actions. This is a material description-behavior mismatch, even if this script may be a small part of a larger skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents an end-user integration skill for interacting with X and Grok. The actual code chunk is purely a development/CI-style validator that uses ripgrep to enforce file presence and documentation conventions for the skill package. This is a materially different primary purpose from the declared behavior. While such validation may support the skill's implementation, the supplied code itself does not perform the described X/Grok operations or resource access.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The skill instructs users to run npx playwright install without pinning a specific Playwright version. Because npx resolves packages dynamically, this can fetch unexpected or compromised package versions at execution time, creating a supply-chain risk on the host running the skill.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 77% confidence

Finding

The skill explicitly relies on an authenticated browser profile at a persistent default path (~/.uxc/webmcp-profile/x) and exposes read/write actions against that session. Persistent authenticated state increases the blast radius of local compromise, misuse by other processes/users on the machine, or accidental posting through a stale session.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

- `x-webmcp-cli tweet.get '{"url":"https://x.com/.../status/..."}'`
   - `x-webmcp-cli tweet.conversation.get '{"id":"2033895522382319922","limit":10}'`
   - `x-webmcp-cli user.get username=jack`
5. Use write tools only after reading help and confirming user intent:
   - `x-webmcp-cli tweet.create '{"text":"hello from webmcp","dryRun":true}'`
   - `x-webmcp-cli tweet.reply '{"id":"2033895522382319922","text":"reply text","dryRun":true}'`
   - `x-webmcp-cli article.publishMarkdown '{"markdownPath":"/abs/path/post.md","dryRun":true}'`

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest combines a broad default prompt with implicit invocation, allowing the skill to activate in general X/Grok-related conversations without an explicit user opt-in. Because the skill operates through an authenticated browser profile and can both read and write data, overbroad triggering increases the chance of unintended access to private timelines, account state, or posting actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The default prompt directs the agent to use the X connection path by default, without signaling that this should happen only after user choice or consent. In the context of an authenticated social-media skill, this can lead to unnecessary or premature access to account data, even if no malicious behavior is intended.

Content

No source excerpt is available for this finding.