zeelin-twitter-x-auto-ops

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:43 AM UTC
• Version: 1.2.1

Overview

The skill is clearly meant for Twitter/X automation, but it can publish from a user’s account through unverified local scripts and under-scoped automatic workflows.

Review carefully before installing. Use only with an account intended for ZeeLin/AI promotional automation, avoid noninteractive auto-posting on a valued account, require manual review of every final tweet, and replace the hard-coded external publisher paths with a bundled or integrity-checked implementation before use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/auto_ai_tweet.sh:29

Finding

Automatic Tweets Are Hijacked to Promote a Fixed External Site

Content

View full analysis

# # #AI #TechTwitter # Try to extract a short summary sentence from the site SUMMARY=$(curl -s "$REPORT_SITE" | grep -m1 -oE ']*>[^<]+' | sed 's/]*>//') # Fallback summary if extraction fails if [ -z "$SUMMARY" ]; then SUMMARY="A new report analyzing recent developments in AI systems and governance." fi TWEET="New AI research report released. ${LATEST_TITLE} ${SUMMARY} Report: ${REPORT_SITE} #AI #TechTwitter" bash "$TWEET_SCRIPT" "$TWEET" "https://x.com" ``` ### Technical Analysis `auto_ai_tweet.sh` fetches unrelated AI headlines from the Hacker News API but places those headlines under text claiming that a new research report has been released. All three randomly selected tweet templates append the same fixed ZeeLin report URL. The user cannot select a neutral template, and the script proceeds directly to the external posting component. This behavior hijacks the requested output by converting a generic AI trend tweet into promotion for a predetermined external property. It can also create misleading attribution by presenting third-party Hacker News headline ...[truncated 1219 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/ai_trend_autotweet.sh:8

Finding

User-Controlled Search Queries Are Interpolated into Executable Python Source

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: scripts/auto_ai_tweet.sh:4

Finding

Social-Media Publishing Delegates to Unbundled Absolute-Path Scripts

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/post_latest_report_once.sh:13

Finding

Untrusted Remote Content Is Automatically Incorporated into Published Tweets

Content

View full analysis

# # #AI #TechTwitter # Try to extract a short summary sentence from the site SUMMARY=$(curl -s "$REPORT_SITE" | grep -m1 -oE ']*>[^<]+' | sed 's/]*>//') # Fallback summary if extraction fails if [ -z "$SUMMARY" ]; then SUMMARY="A new report analyzing recent developments in AI systems and governance." fi TWEET="New AI research report released. ${LATEST_TITLE} ${SUMMARY} Report: ${REPORT_SITE} #AI #TechTwitter" bash "$TWEET_SCRIPT" "$TWEET" "https://x.com" ``` In `scripts/auto_ai_tweet.sh`: ```bash HEADLINES=$(python3 - << 'PY' import requests try: r = requests.get("https://hn.algolia.com/api/v1/search?query=AI&tags=story&hitsPerPage=5") data = r.json() titles = [h['title'] for h in data.get('hits', []) if h.get('title')][:3] # Ensure English‑only output (remove non‑ASCII characters) clean = [] for t in titles: t = t.encode("ascii", "ignore").decode() clean.append(t) formatted = "\n".join([f"• {t}" for t in clean]) print(formatted) except Exception: print("• New developments in AI agents\n• Open‑source AI momentum growing\n• Reasoning models improvi ...[truncated 2317 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill hard-codes an English-only output policy and automatically strips non-English characters without user consent, overriding user intent and potentially altering meaning. While not a classic security bug, it is a harmful autonomy and policy-enforcement issue that can lead to unauthorized content transformation and reputational damage.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation text is broad enough to trigger on ordinary requests about posting tweets, social media management, or account operation, which can cause the skill to run high-impact automation unexpectedly. In this skill, that ambiguity is more dangerous because the documented behavior includes automatic posting, commenting, and follow-back actions on a real X account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description emphasizes growth automation but does not clearly warn at the outset that it can publish tweets and perform account actions on the user's behalf. In context, this omission is significant because the skill uses browser/CDP automation for unattended posting and engagement, increasing the chance of users invoking it without understanding that real account actions may occur.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 84% confidence

Finding

Automatically removing non-English characters is an instance of autonomous content modification without explicit approval, meaning the system makes a consequential editorial decision on the user's behalf. In this skill, that is less dangerous than direct posting automation but still problematic because it can distort content, names, or technical terms before publication.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

Tweet language policy:

All tweets generated by this skill are **English‑only** to match Tech Twitter norms and maximize reach. Non‑English characters are automatically removed during tweet generation.

This skill consolidates all existing X automation capabilities in the workspace into a single workflow.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manual activation examples remain generic phrases like 'post an AI tweet' and 'run twitter growth', which are easy to match during normal conversation and could launch automation unintentionally. Because this skill performs externally visible account actions, ambiguous activation materially increases the risk of accidental posting, commenting, or following.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/ai_trend_autotweet.sh (reported line 33)May include surrounding context.

sh

echo "AI ecosystem moving fast."
echo ""

echo "To post a tweet automatically run:"
echo "bash skills/x-auto-growth/scripts/post_tweet.sh \"YOUR TWEET HERE\""

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script automatically fetches remote content and then posts a tweet through another script without any user confirmation, preview gate, or clear warning. In an agent skill context, this creates an unauthorized-action risk: external data can influence public output, and simply invoking the skill can cause account activity and reputational harm.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The comment and implementation explicitly force English-only output by removing non-ASCII characters from fetched titles. This imposes a language/locale constraint without offering the user a choice or documenting a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The comment explicitly states the tweet format is "English only," which imposes a language choice rather than offering a user-selectable locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script presents itself as a single workflow for trend discovery and engagement, but it also performs an external side-effect: publishing a tweet through another script when user input is provided. This mismatch in declared behavior reduces transparency and can cause an operator to trigger account actions they did not expect, especially because the actual posting logic is delegated to a separate script not visible here.

Content

No source excerpt is available for this finding.