Twitter Trend Radar

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:57 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed read-only X/Twitter trend research helper, but users should be careful with its third-party bird CLI dependency and browser-profile access.

Install only if you are comfortable using a third-party bird CLI with X/Twitter access. Prefer a pinned, reviewed bird version, run it with a dedicated browser profile or low-privilege account, review cached files under .cache/twitter-trend-radar, and avoid using sensitive private search topics unless you expect them to be sent to external services.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:49

Finding

Unpinned Global Installation of a Third-Party CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49-55
Vulnerability Type: Supply-chain risk from an unpinned globally installed dependency
Risk Level: Medium

Vulnerable Code Snippet:

markdown

Recommended bird setup:

```bash
bun add -g @steipete/bird

text

### Technical Analysis

The installation guidance directs users to retrieve and globally install the latest available version of the third-party `@steipete/bird` package. It does not pin a reviewed version, verify a checksum or signature, or use a lockfile.

Consequently, the package installed by a user can differ from the version assessed when this Skill was reviewed. If the package, publisher account, registry entry, or distribution channel is compromised, installation or subsequent execution could run attacker-controlled code with the privileges of the user running Bun.

This risk is particularly relevant because the Skill expects `bird` to interact with browser-authenticated X/Twitter sessions. Although the bundled Python script does not directly access credentials, a compromised `bird` package could potentially access credentials and other data available to its process.

### Attack Path

1. An attacker compromises the package publisher account, registry package, or upstream release process.
2. The attacker publishes a malicious package version under the expected package name.
3. A user follows the documented `bun add -g @steipete/bird` instruction.
4. Bun retrieves the current attacker-controlled release because no version or integrity value is specified.
5. Malicious package lifecycle behavior or later invocation of `bird` executes under the installing user's account.
6. The payload may access data available to that user, including browser session material, and communicate it externally.

### Impact Assessment

Successful exploitation could execute code with the privileges of the user who installs or invokes the package. The
...[truncated 463 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @steipete/bird to a specific reviewed version rather than installing the latest release:

   bash

   bun add @steipete/bird@<reviewed-version>
   

2. Prefer a project-local dependency over a global installation to limit scope and improve reproducibility.
3. Commit and enforce an appropriate lockfile so dependency resolution remains stable.
4. Verify package provenance and document the authoritative registry and upstream repository.
5. Where supported, verify release signatures or published integrity hashes before installation.
6. Review dependency updates before changing the pinned version, including package ownership, lifecycle scripts, and transitive dependency changes.
7. Run the CLI with least privilege and a dedicated browser profile containing only the minimum account access required.
8. Disable or avoid package lifecycle scripts during installation where operationally feasible.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill invokes shell commands, performs network lookups, and can write output files, but the manifest declares no explicit tool scope or permission boundaries. That makes the skill harder to sandbox and increases the chance an agent may run it with broader capabilities than intended, especially because it relies on external CLIs and network access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The activation guidance is broad enough to trigger on common research requests like trending topics, products, tools, or games, which may cause the agent to invoke this skill unexpectedly. In context, that matters because the skill can execute shell commands, access network resources, and write reports, so accidental activation expands operational risk beyond simple text assistance.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/twitter_trend_radar.py (reported line 225)May include surrounding context.

python

return []

    try:
        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=90)
    except FileNotFoundError:
        raise SystemExit("bird CLI not found. Install bird and make sure it is on PATH.")
    except subprocess.TimeoutExpired:

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill sends user-supplied search topics and discovered domains to external services (bird/X search and rdap.org) and also caches returned tweet/domain data locally, but it does not present an explicit privacy warning or consent checkpoint before doing so. In environments where queries or cached results may be sensitive, this can cause unintentional data disclosure to third parties and leave local artifacts that persist beyond the run.

Content

No source excerpt is available for this finding.