T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/scrape_x_v9.py:27- Finding
Hard-Coded X.com Bearer Token in Source Code
- Content
View full analysis
- Remediation
View remediation
Security audit
X-scraper/推文抓取工具
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent X.com tweet scraper, but it asks users to export live login cookies and performs authenticated scraping without enough safety disclosure or containment.
Review before installing. Only use this skill if you are comfortable exporting X.com login cookies; treat the cookie file like a password, keep it out of source control, restrict local access, delete it after use, and consider revoking the browser session afterward. Use a dedicated low-risk account or isolated profile, back up seed JSON files before running because scripts can overwrite them, and install dependencies in an isolated environment with pinned versions where possible.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
README_EN.md:26- Finding
Unpinned Playwright Dependency and Browser Artifact Installation
- Content
View full analysis
- Remediation
View remediation
``` 2. Generate and verify package hashes, for example through a hash-locked requirements file: ```bash pip install --require-hashes -r requirements.txt ``` 3. Commit a lock file generated by a trusted dependency-management tool. 4. Use the official Python package index or an authenticated organizational mirror. 5. Run dependency vulnerability and provenance checks in CI. 6. Document the expected Playwright and Chromium versions. 7. Install dependencies in an isolated virtual environment or container with least privilege. 8. Review and update pinned versions through an explicit, auditable maintenance process rather than using an unconstrained latest release. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/scrape_x_scroll.py:290- Finding
Undefined Profile URL Causes DOM-Scroll Strategy Failure and Potential Data Loss
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (21)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
The description omits important operational behaviors such as use of exported authentication cookies and local state persistence. That mismatch can mislead a user or agent into handling sensitive session material and writing artifacts to disk without understanding the security implications, which is more serious than a mere feature-description inconsistency.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The description omits important operational behaviors such as use of exported authentication cookies and local state persistence. That mismatch can mislead a user or agent into handling sensitive session material and writing artifacts to disk without understanding the security implications, which is more serious than a mere feature-description inconsistency.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description omits important operational behaviors such as use of exported authentication cookies and local state persistence. That mismatch can mislead a user or agent into handling sensitive session material and writing artifacts to disk without understanding the security implications, which is more serious than a mere feature-description inconsistency.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README advertises large-scale collection of tweet history and states that the tooling uses real browsers to bypass anti-scraping protections, yet it omits any warning about privacy, account integrity, platform policy, or operational risk. That omission is security-relevant because users may run the skill without understanding that aggressive automation and anti-detection behavior can trigger account restrictions, leak browsing/session state, or facilitate abusive data collection.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README instructs users to export X.com login cookies and use them with a scraping workflow that explicitly aims to bypass anti-scraping protections, but it provides no warning about the sensitivity of session cookies or the risk of account takeover if those cookies are exposed. In this context, session cookies function like credentials, and normalizing their export increases the chance they are mishandled, reused insecurely, or committed to disk without protection.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README instructs users to export live X.com login cookies and store them in a local JSON file, but provides no warning that these cookies are bearer-equivalent authentication secrets. If mishandled, shared, committed to source control, or accessed by other local processes, they could enable account takeover or unauthorized access to the user's X.com session.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill documents capabilities that clearly require network access plus local file read/write, but it does not declare any tool scope or permission boundaries. In an agent ecosystem, this increases the chance that an operator or orchestrator will invoke the skill with broader access than intended, making data collection and local persistence less transparent and harder to govern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs users to export X.com cookies from a browser and save them to disk, effectively handling session credentials in portable form without any warning about sensitivity, theft risk, or account compromise. If those JSON cookie files are exposed, reused by another process, or committed to source control, an attacker could hijack the X account session and access or act as the user.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow explicitly instructs users to export authenticated X.com cookies to a local JSON file but provides no warning that these cookies are sensitive session credentials. If mishandled, leaked, or reused by other tools, they can enable account hijacking or unauthorized access to the user's X.com session. In the context of a scraping skill, this is more dangerous because the workflow normalizes credential export as part of routine operation, increasing the chance users will store or share the file insecurely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script silently loads authentication cookies from disk and injects them into a Playwright browser context, causing subsequent requests to run under the user's X account session. In a skill context, this is sensitive because it reuses account credentials without an explicit warning, consent gate, or validation of cookie provenance, increasing the chance of unintended account-linked activity or misuse of stolen session material.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script performs automated authenticated scraping against X.com, including repeated searches and scrolling-driven collection, without any explicit operator warning that external requests and account-associated actions will occur. In an agent skill, that lack of transparency is security-relevant because users may unknowingly trigger high-volume network activity tied to their account, with risks including account restriction, privacy issues, and collection of more data than intended.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring says the skill will start from the earliest tweets and search forward chronologically, and the gen_chunks docstring says it generates chunks from the earliest account date to today. In reality, gen_chunks ignores the discovered oldest tweet date and hard-codes the search start at 2025-07-01, so the documented behavior contradicts the implemented date range.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script overwrites the user-supplied seed JSON file in place after merging results, with no backup, confirmation, or separate output target. In an automation/agent setting, this can cause silent data loss or corruption of an input dataset, especially if the supplied path points to an important file or a shared artifact expected to remain immutable.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The header documentation says the script 'opens a user homepage' and simulates scrolling, implying a profile-based workflow. In code, the first major collection phase uses search URLs for monthly ranges, and the later homepage-navigation section logs and visits
profile_urleven though no such variable is defined, contradicting the documented operational path.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
SQP-3 applies to all file types and includes language or locale policy violations. This file presents its top-level description exclusively in Chinese, and there is no indication that the user can choose another language or that the locale restriction is justified as region-specific.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module docstring describes a browser scrolling mode that opens a user's homepage and extracts tweets from the DOM, but this function first constructs monthly search queries and scrapes X search result pages across date ranges. That is a materially broader behavior than simply scrolling a profile page, because it pivots into search-based collection logic before the later profile-scrolling phase.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The argparse description and help strings are all written in Chinese, which imposes a specific language on users of the tool. Under SQP-3, this is a natural-language policy issue unless the tool offers a language choice or clearly documents a justified locale-specific scope.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script loads authenticated X.com session cookies from a local JSON file and uses them to impersonate a logged-in browser session without any user-facing disclosure, consent flow, or validation of how those credentials were obtained. In the context of a scraping skill specifically designed to access authenticated content, this increases the risk of unauthorized account use, accidental misuse of exported session tokens, and leakage of sensitive session material through poor operational handling.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The code issues authenticated GraphQL requests using a hardcoded bearer token plus the operator's session cookies and CSRF token, causing account-linked data transmission to X.com without any explicit user warning at runtime. In a scraping tool whose purpose is bulk collection from an authenticated session, this creates a meaningful risk of users unknowingly sending privileged requests, triggering account abuse, policy violations, or exposing session-derived access patterns.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The module docstring and runtime log messages are written in Chinese, which forces a specific language experience for users and operators. The file does not offer language selection or explain that the skill is intentionally limited to a Chinese-speaking context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This request header hard-codes
x-twitter-client-languagetoen, imposing a specific locale regardless of user preference. There is no option, opt-in, or justification indicating that English is required for a region-specific or compliance-related reason.- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/scrape_x_v9.py:23