X Founder Operations

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:00 AM UTC
• Version: 0.1.0

Overview

The skill is a disclosed X/Twitter strategy and analytics assistant with no hidden installer or persistence, but users should keep manual control over posting and DMs.

Install only if you want an agent to help with X/Twitter account operations. Review any generated posts, replies, or DMs before publishing, provide only the account/config data you intend it to use, and treat analytics recommendations cautiously until the validation script rejects anomalous records instead of merely flagging them.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/x_data_validator.py:203

Finding

Invalid X Records Remain Accepted After Integrity and Sanity-Check Failures

Content

View full analysis

impressions: checks.append({ "step": "sanity_check_likes", "status": "ERROR", "tweet_id": tweet_id, "message": f"IMPOSSIBLE: Likes ({likes}) > Impressions ({impressions})", "action": "FLAG_ANOMALY — data error detected but not modified", "severity": "ERROR" }) self._log_error("Data anomaly: likes > impressions", { "tweet_id": tweet_id, "likes": likes, "impressions": impressions }) if retweets is not None and impressions is not None and retweets > impressions: checks.append({ "step": "sanity_check_retweets", "status": "ERROR", "tweet_id": tweet_id, "message": f"IMPOSSIBLE: Retweets ({retweets}) > Impressions ({impressions})", "severity": "ERROR" }) self._log_error("Data anomaly: retweets > impressions", { "tweet_id": tweet_id, "retweets": retweets, "impressions": impressions }) for metric_name in required_metrics: value = metrics.get(metric_name) if value is not None and value < 0: checks.append({ "step": f"sanity_check_{metric_name}", "status": "ERROR", ...[truncated 3210 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description presents a comprehensive X operations skill for managing an account end-to-end. The supplied code chunk only implements the analytics/reporting portion of that larger vision. It does not create content, manage posting, engage with users, run competitor analysis, develop personas, or orchestrate a full daily Plan-Do-Check-Act loop. Its primary purpose is performance analysis of validated tweets and report generation. This is a materially narrower behavior than the declared purpose, so the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a comprehensive X operations skill focused on strategy, creation, engagement, promotion, and optimization workflows. The supplied code does not implement those behaviors. Instead, it only validates analytics data integrity and computes limited summary metrics from tweet data. While this validator could support a broader analytics or optimization system, the actual code chunk’s primary purpose is materially narrower and different from the declared end-to-end X operations capability. No undeclared risky capability is evident, but there is a strong description-to-behavior mismatch because most declared capabilities are absent from the code.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 70% confidence

Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · references/cron-schedule.md (reported line 134)May include surrounding context.

md

4. Generate engagement recommendations

**Engagement criteria**:
- Replies from accounts in your core circle (always respond)
- Thoughtful replies that add value (respond with depth)
- Questions about your domain (reply with expertise)
- Mentions by larger accounts (respond promptly)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

auto_invoke: true combined with a broad description can cause the skill to trigger on routine social-media requests without clear user intent. In practice, that increases the chance of unintended file reads, overbroad strategic guidance, or activation in contexts where the user did not consent to this specialized workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Several example triggers are broad enough to match common planning or optimization requests, which can cause over-triggering of this skill outside its intended scope. Over-triggering matters because this skill references scripts, configs, analytics, and operational workflows that a user may not expect to engage for a generic content-planning request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The report labels hourly output as UTC and tells users to convert it afterward, which bakes a specific timezone/locale assumption into the skill's natural-language behavior. Under the policy, forcing a locale choice without opt-in can be a violation when the skill is not clearly documented as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The instruction 'For bilingual users: English for technical/international content, native language for personal/cultural content' prescribes a language policy rather than offering a choice. This can conflict with organizational expectations that users control language or locale unless the constraint is explicitly optional and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This manifest template specifies English as the primary language and describes a fixed language-mixing strategy, which can be read as prescribing a default language behavior rather than offering a user-selected option. The policy allows locale or language constraints when users are given a choice or the constraint is clearly justified, neither of which is stated here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Line L153 uses the Chinese phrase "活人感" in otherwise English guidance. The file does not indicate that multilingual output is optional or justified for a region-specific audience, which can conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The document states that the target audience timezone is usually US East or US West and builds recommended peak windows around that assumption. Because this is natural-language guidance in a generally applicable schedule document, it steers users toward a specific locale without presenting it as optional or region-specific policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Line L013 introduces the Chinese phrase "活人感" inside an otherwise English-language guide, and the term is later reused as a section heading at L144. The file does not offer a language/locale preference or explain that multilingual terminology is required for a region-specific audience, which can violate language-consistency policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

Line L003 includes the phrase "夹带私货" as part of the instructional content without offering a language choice or explaining that the content is intended for Chinese-speaking users. This can violate language/locale policy expectations because the skill imposes a language element on all readers rather than making it optional or context-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.