Security audit

Keyapi Twitter Content Analytics

Security checks for vulnerabilities and agentic risk

Overview

This Twitter/X analytics skill is not clearly malicious, but its bundled runner is broader than the Twitter-only description and handles the API token in ways users should review.

Install only if you are comfortable giving the skill a KeyAPI token and storing Twitter/X query results locally. Prefer setting KEYAPI_TOKEN in your shell instead of entering it at the prompt, avoid KEYAPI_SERVER_URL unless you trust the endpoint, and delete or protect any .env file created in the skill directory.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/run.js:48
Finding: Arbitrary MCP Endpoint Override Can Disclose the API Token
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/run.js:240
Finding: API Token Is Persisted in a Plaintext File Without Explicit Restrictive Permissions
Content: View full analysis
.env" ); } const { createInterface } = await import("readline"); const rl = createInterface({ input: process.stdin, output: process.stderr }); return new Promise((resolve, reject) => { process.stderr.write("\nKEYAPI_TOKEN is required. Get yours at https://keyapi.ai/\n\n"); rl.question("Enter your token: ", (answer) => { rl.close(); const token = answer.trim(); if (!token) { reject(new Error("No token entered. Set KEYAPI_TOKEN and try again.")); return; } const envPath = join(ROOT, ".env"); writeFileSync(envPath, `KEYAPI_TOKEN=${token}\n`, "utf8"); log(`[token] Saved to ${envPath} — future runs will load it automatically`); process.env.KEYAPI_TOKEN = token; resolve(token); }); }); } ``` ### Technical Analysis When no token is available, the runner prompts the user and automatically stores the submitted credential in a plaintext `.env` file within the Skill directory. The `writeFileSync` call does not specify restrictive file permissions. The resulting permissions depend on the process umask and surrounding filesystem configuration. In permissive environments, other local users or processes may be able to read the credential. Storing the file inside the project also increases the possibility that it will be copied into archives ...[truncated 1189 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (34)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The static finding indicates the skill can drive a generic multi-platform MCP runner and invoke arbitrary available server tools, while the description presents it as Twitter/X-specific analytics. That mismatch is dangerous because users and policy systems may grant trust or access based on the declared purpose, while the actual capability surface is broader and may include unrelated platforms, filesystem writes, and token handling not disclosed in the description.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
md
node scripts/run.js --platform twitter --list-tools

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.
md
node scripts/run.js --platform twitter --list-tools

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.
md
node scripts/run.js --platform twitter --list-tools

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.
md
node scripts/run.js --platform twitter --list-tools

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.
md
node scripts/run.js --platform twitter --list-tools

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.
md
node scripts/run.js --platform twitter --list-tools

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.
md
node scripts/run.js --platform twitter --list-tools

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.
md
node scripts/run.js --platform twitter --list-tools

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.
md
node scripts/run.js --platform twitter --list-tools

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.
md
node scripts/run.js --platform twitter --list-tools

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.
md
node scripts/run.js --platform twitter --list-tools

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.
md
node scripts/run.js --platform twitter --list-tools

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 204)May include surrounding context.
md
node scripts/run.js --platform twitter --list-tools

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.
md
node scripts/run.js --platform twitter --list-tools

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.
md
node scripts/run.js --platform twitter --list-tools

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.
md
node scripts/run.js --platform twitter --list-tools

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.
md
node scripts/run.js --platform twitter --list-tools

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 239)May include surrounding context.
md
node scripts/run.js --platform twitter --list-tools

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/run.js (reported line 45)May include surrounding context.
js
const __dirname = dirname(fileURLToPath(import.meta.url)); const ROOT = resolve(__dirname, ".."); // ── .env loader ─────────────────────────────────────────────────────────────── (function loadDotenv() { const envPath = join(ROOT, ".env");

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/run.js (reported line 106)May include surrounding context.
js
const __dirname = dirname(fileURLToPath(import.meta.url)); const ROOT = resolve(__dirname, ".."); // ── .env loader ─────────────────────────────────────────────────────────────── (function loadDotenv() { const envPath = join(ROOT, ".env");

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/run.js (reported line 240)May include surrounding context.
js
const __dirname = dirname(fileURLToPath(import.meta.url)); const ROOT = resolve(__dirname, ".."); // ── .env loader ─────────────────────────────────────────────────────────────── (function loadDotenv() { const envPath = join(ROOT, ".env");

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/run.js (reported line 247)May include surrounding context.
js
const __dirname = dirname(fileURLToPath(import.meta.url)); const ROOT = resolve(__dirname, ".."); // ── .env loader ─────────────────────────────────────────────────────────────── (function loadDotenv() { const envPath = join(ROOT, ".env");

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/run.js (reported line 48)May include surrounding context.
js
// ── .env loader ─────────────────────────────────────────────────────────────── (function loadDotenv() { const envPath = join(ROOT, ".env"); if (!existsSync(envPath)) return; for (const line of readFileSync(envPath, "utf8").split("\n")) { const m = line.match(/^\s*([A-Z_][A-Z0-9_]*)\s*=\s*(.*)$/);

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/run.js (reported line 248)May include surrounding context.
js
// ── .env loader ─────────────────────────────────────────────────────────────── (function loadDotenv() { const envPath = join(ROOT, ".env"); if (!existsSync(envPath)) return; for (const line of readFileSync(envPath, "utf8").split("\n")) { const m = line.match(/^\s*([A-Z_][A-Z0-9_]*)\s*=\s*(.*)$/);

Static analysis

No suspicious patterns detected.