Twitter Web AutoPoster

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:15 AM UTC
• Version: 0.1.0

Overview

This skill is transparent about automating X/Twitter posts, but it can publish generated public posts without per-post confirmation, so users should review it carefully before installing.

Install only if you intentionally want an agent to operate your logged-in X/Twitter account. Use review-first mode for normal use, and avoid full automatic posting unless you are comfortable with the agent choosing content and publishing publicly without showing you each post first.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill metadata advertises fully automatic posting without user confirmation, but does not pair that capability with a prominent warning that posting is public and may be irreversible. That makes misuse or accidental invocation more likely, especially when combined with browser-based access to an already logged-in account.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The instructions explicitly allow the agent to skip confirmation and post directly when the user says 'full automatic' or 'don't ask me', removing the final safety checkpoint before an irreversible public action. In this skill's context, that is particularly risky because generated content may be selected and published autonomously from trending topics, increasing the chance of reputational harm, policy violations, or posting content the user did not actually review.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger conditions are broad enough to activate on common conversational requests about writing or posting on X, increasing the chance the agent invokes a high-impact browser automation skill when the user may have only intended drafting assistance. In this context, unintended activation is more dangerous because the same skill can proceed to live posting, including in fully automatic mode, creating a path from ambiguous intent to irreversible public action.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: This example directs the agent to write an English tweet, and the skill elsewhere notes UI language variability but does not frame output language as a user-selectable preference. Because the examples normalize forcing a specific language, the document risks a language-policy violation unless language choice is explicitly user-driven or opt-in.

Static analysis

No suspicious patterns detected.