Bytesagain X Manager

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:23 AM UTC
• Version: 1.6.0

Overview

The skill is mostly aligned with X account automation, but it can publish and engage publicly with weak approval, state-file, and disclosure safeguards.

Install only if you are comfortable giving it read/write control of the target X account and letting it send monitored content to xAI and Telegram. Before use, add explicit confirmations or dry-run defaults for posting, liking, and replies; fix the reply approval enforcement; move state out of shared /tmp paths; and use a dedicated low-privilege X account or tightly scoped credentials.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/script.sh:24

Finding

Command Injection Through Bash Arithmetic Evaluation of --index

Content

View full analysis

Remediation

View remediation

&2 exit 2 fi index="$2" ``` Additional hardening should include: - Reject unknown options instead of silently shifting past them. - Reject a missing value after `--index`. - Avoid evaluating untrusted strings in shell arithmetic. - Perform arithmetic only after strict regular-expression and range validation. - Add negative tests using malformed values, arithmetic expressions, array subscripts, and command substitutions. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/x-engage.py:270

Finding

Mention Reply Approval Can Be Bypassed With Arbitrary Reply Text

Content

View full analysis

0: print(f"⏳ 等待 {delay}s...") time.sleep(delay) auth = get_auth() # 从待确认队列找回复内容 if not reply_text: try: pending = json.load(open(PENDING_FILE)) for p in pending: if p["tweet_id"] == tweet_id: reply_text = p["draft_reply"] break except: pass if not reply_text: print(f"找不到 {tweet_id} 的回复内容") return resp = requests.post( "https://api.twitter.com/2/tweets", auth=auth, json={ "text": reply_text, "reply": {"in_reply_to_tweet_id": tweet_id} }, timeout=15 ) ``` The command-line interface also directly exposes arbitrary reply content: ```python parser.add_argument("--reply-text", help="回复内容（可选，不填则用草稿）") ``` ### Technical Analysis The documented safety boundary states that mention replies require human approval. The implementation does not maintain or verify an approved state. If `reply_text` is provided, `run_send()` skips the pending-queue lookup entirely. It then posts the supplied text to any provided tweet ID. There is no check that: - The target tweet ID is in the pending queue. - A Telegram operator approved the reply. - The supplied text matches the reviewed draft. - The approval came from the configured Telegram chat. - The approval is recent, authentic, or unused. Even when `--reply-text` is omitted, finding a draft in the pending queue is treated as equivalent to approval, although the queue represents messages awaiting approval. ### Attack Path 1. A caller with access to invoke the Python script supplies `--send` with an arbi ...[truncated 1000 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/x-monitor.py:302

Finding

Predictable Shared Temporary Draft File Enables Content Poisoning and Symlink Attacks

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/x-engage.py:146

Finding

Public Mention Content Can Manipulate LLM Replies and Telegram Approval Rendering

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (45)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/x-engage.py (reported line 18)May include surrounding context.

python

�复"发"后，实际发出回复

用法:
  python3 x-engage.py --like       # 自动点赞
  python3 x-engage.py --monitor    # 监控提及，发 Telegram 待确认
  python3 x-engage.py --send <tweet_id> <reply_text>  # 实际发回复（Kelly确认后触发）
"""
import os, sys, json, requests, argparse
from datetime import datetime, timezone
from requests_oauthlib import OAuth1

TG_TOKEN = os.environ.get("TG_TOKEN", "")
TG_CHAT  = os.environ.get("TG_CHAT", "")
PENDING_FILE = os.path.expanduser("~/.local/share/x-manager/pending-replies.json")
os.makedirs(os.path.dirname(PENDING_FILE), exist_ok=True)

# ── 初始化 ──────────────────────────────────────────────────────────────────
def load_env():
    pass  # All credentials must be set as environment variables

def get_auth():
    return OAuth1(
        os.environ["X_API_KEY"], os.environ["X_API_

Tainted flow: 'req' from os.environ.get (line 162, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/x-engage.py (reported line 43)May include surrounding context.

python

data=req_data,
            headers={"Content-Type": "application/json"}
        )
        urllib.request.urlopen(req, timeout=10)
    except Exception as e:
        print(f"TG发送失败: {e}")

Direct flow: os.environ.get (credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/x-engage.py (reported line 101)May include surrounding context.

python

if metrics.get("like_count", 0) < 1 and metrics.get("retweet_count", 0) < 1:
                    continue

                like_resp = requests.post(
                    f"https://api.twitter.com/2/users/{os.environ.get('X_USER_ID', '')}/likes",
                    auth=auth,
                    json={"tweet_id": tid},

Tainted flow: 'req' from os.environ.get (line 162, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/x-engage.py (reported line 170)May include surrounding context.

python

"Content-Type": "application/json"
            }
        )
        with urllib.request.urlopen(req, timeout=30) as r:
            result = json.loads(r.read())
        return result["choices"][0]["message"]["content"].strip()
    except Exception as e:

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/x-monitor.py (reported line 42)May include surrounding context.

python

data=json.dumps(payload).encode(),
        headers={"Authorization": f"Bearer {key}", "Content-Type": "application/json"}
    )
    with urllib.request.urlopen(req, timeout=60) as r:
        result = json.loads(r.read())
    text = ""
    for item in result.get("output", []):

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/x-monitor.py (reported line 77)May include surrounding context.

python

data=json.dumps(payload).encode(),
            headers={"Authorization": f"Bearer {key}", "Content-Type": "application/json"}
        )
        with urllib.request.urlopen(req, timeout=30) as r:
            result = json.loads(r.read())
        return result["choices"][0]["message"]["content"].strip()
    except Exception as e:

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/x-monitor.py (reported line 90)May include surrounding context.

python

data=json.dumps(payload).encode(),
        headers={"Content-Type": "application/json"}
    )
    urllib.request.urlopen(req, timeout=10)

# ── 1. 热点监控 ───────────────────────────────────────────────────────────────
def run_monitor():

Tainted flow: 'auth' from os.environ.get (line 233, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/x-monitor.py (reported line 239)May include surrounding context.

python

os.environ.get("X_ACCESS_TOKEN", ""),
            os.environ.get("X_ACCESS_TOKEN_SECRET", "")
        )
        resp = req_lib.post(
            "https://api.twitter.com/2/tweets",
            auth=auth,
            json={"text": text},

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This second mismatch finding likewise points to underdeclared behavior: direct posting, external xAI usage, file persistence, and competitor tracking materially affect both privacy and account activity but are not consistently surfaced in the top-level description. In an account-automation skill, underdescribing these actions increases the risk of unintended posting, reputation damage, and data sharing to third parties.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This second mismatch finding likewise points to underdeclared behavior: direct posting, external xAI usage, file persistence, and competitor tracking materially affect both privacy and account activity but are not consistently surfaced in the top-level description. In an account-automation skill, underdescribing these actions increases the risk of unintended posting, reputation damage, and data sharing to third parties.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

description: X API Key Secret
    required: true
  - name: X_ACCESS_TOKEN
    description: X Access Token (account-specific, Read+Write)
    required: true
  - name: X_ACCESS_TOKEN_SECRET
    description: X Access Token Secret

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

description: X API Key Secret
    required: true
  - name: X_ACCESS_TOKEN
    description: X Access Token (account-specific, Read+Write)
    required: true
  - name: X_ACCESS_TOKEN_SECRET
    description: X Access Token Secret

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md

description: X API Key Secret
    required: true
  - name: X_ACCESS_TOKEN
    description: X Access Token (account-specific, Read+Write)
    required: true
  - name: X_ACCESS_TOKEN_SECRET
    description: X Access Token Secret

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

description: X API Key Secret
    required: true
  - name: X_ACCESS_TOKEN
    description: X Access Token (account-specific, Read+Write)
    required: true
  - name: X_ACCESS_TOKEN_SECRET
    description: X Access Token Secret

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-notes.md (reported line 6)May include surrounding context.

md

## Auth
- OAuth 1.0a (user context) — required for posting, liking, following
- App must have Read + Write permissions
- Access Token is account-specific (tied to @bytesagain)

## Rate Limits (Pay-per-use tier)
- POST /tweets: charged per call (~$0.000005/tweet)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The header comment says drafts are for manual posting, but the code includes an --auto-post path that publishes directly to X. That mismatch is dangerous because operators may grant credentials under the assumption of non-posting behavior, enabling unauthorized or unexpected public actions from a supposedly low-risk monitoring skill.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares powerful capabilities through its documented behavior and required credentials—environment access, file writes to /tmp, and outbound network calls to X, xAI, and Telegram—but does not declare any tool scope or permissions boundary. That omission weakens informed consent and platform enforcement, making it easier for a user or runtime to underestimate what the skill can do with account-linked credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill performs automatic engagement and posting operations that can directly affect a user's public account, yet the description lacks a prominent warning about reputational, moderation, and platform-policy risks. In a social-media automation context, insufficient warning is more dangerous because actions are externally visible and may be hard to undo.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The statement that 'No credentials are stored or transmitted by this skill' is misleading in context because the skill uses those credentials to authenticate outbound requests and forwards authenticated-workflow content to external services such as xAI and Telegram. Misrepresenting data flow can cause users to approve a skill without understanding that content derived from their account activity is sent to third parties.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The monitor command says it sends a Telegram report with a Chinese summary, and the approval workflow later requires Chinese command words for approval. This imposes a language/locale choice without documenting opt-in, alternatives, or a region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Requiring Chinese-only approval commands without disclosure can create approval mistakes or operational confusion in a workflow that controls public replies. In this context, ambiguity in control commands is security-relevant because misunderstood commands may lead to unintended posting or failure to block a harmful draft.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The trigger cases include very broad phrases such as '帮我发一条推文', 'post a tweet', and '点赞一些AI相关的推文' that can match common user requests without enough contextual constraints, increasing the chance this skill is invoked when the user did not intend to authorize account actions. In an account-management skill that can post, monitor, and like content on X, overbroad triggering can lead to unintended social-media actions, brand risk, and automation misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This script directly triggers social-media actions with real external effects, including posting tweets, auto-liking content, and sending replies, without any interactive confirmation, dry-run default, or visible safety interlock. In the context of an account-management skill, this is more dangerous because accidental invocation, bad upstream AI output, or misuse of automation can immediately cause reputational damage, spam, or unauthorized engagement from the brand account.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation represents that replies are sent only after Kelly confirmation, but the implementation exposes a direct posting path. This security-design mismatch can cause operators to overtrust the safeguard and deploy the skill assuming a human gate exists when it does not.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/x-engage.py (reported line 39)May include surrounding context.

python

req_data = json.dumps(payload).encode()
        import urllib.request
        req = urllib.request.Request(
            f"https://api.telegram.org/bot{TG_TOKEN}/sendMessage",
            data=req_data,
            headers={"Content-Type": "application/json"}
        )

Static analysis

No suspicious patterns detected.