X Tag Responder

• Outcome: Review
• Latest audit: May 29, 2026 · 9:30 PM UTC
• Version: 1.0.0

Overview

This skill is advertised as a manual X reply helper, but it also bundles under-disclosed background automation that can post to X, call Gemini, run unrelated local workflows, and restart a gateway.

Review before installing. Treat this as more than an X drafting helper: disable or remove the daemon and autonomous reply bot unless you explicitly want background posting, liking, Gemini processing, local workflow execution, and gateway restart authority. Require human approval for every public X action and any infrastructure restart, and document the Gemini data flow and required credentials.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements a long-running background daemon that performs multiple actions unrelated to the declared skill purpose of detecting X/Twitter tags and crafting replies. It runs tweet queue processing, meme generation, feed scanning, and invokes a reply bot, which materially expands the skill's authority and attack surface beyond what a user would reasonably expect from the manifest.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This code actively monitors and can restart a WhatsApp gateway even though the skill is described as an X/Twitter thread responder. Cross-domain operational control of unrelated messaging infrastructure is dangerous because compromise or misuse of this skill grants capabilities far outside its advertised purpose.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The call to restart infrastructure via shell command gives this skill direct operational control over external services. Even though the command string is static, the capability itself is high risk because any unintended execution path, logic bug, or compromise of the watcher can trigger disruptive service changes.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The watcher launches unrelated automation pipelines for tweeting, meme generation, and feed scanning, none of which are necessary for responding to X tags in threads. Bundling these capabilities into one agent broadens the blast radius of failures or abuse and creates hidden side effects inconsistent with the declared skill behavior.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The header claims 'no AI calls' and 'Watch + decide + act,' but the script later invokes a reply bot consistent with automated response generation. This mismatch is risky because misleading documentation undermines operator understanding, review, and consent, making hidden behavior harder to detect and govern.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The implementation continuously fetches recent mentions and autonomously replies to any mention that passes lightweight filters, which is broader behavior than the stated skill purpose of responding when a human tags the AI in someone else's thread. This scope mismatch is dangerous because it enables unsolicited autonomous engagement, increasing abuse, impersonation, and policy-violation risk beyond what operators or users would reasonably expect.

Description-Behavior Mismatch

Low

• Confidence: 83% confidence
• Finding: The bot performs an additional side effect by liking tweets before replying, but this behavior is not reflected in the skill description. While not a direct code-execution flaw, undisclosed autonomous interactions can mislead operators about the bot's capabilities and create trust, compliance, or reputation issues if engagement actions are sensitive.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger patterns are broad enough to activate on ordinary conversational requests like 'weigh in on this' or 'reply to this for me,' which can cause the skill to engage public-posting workflows without a tightly bounded invocation context. In a social-media skill, ambiguous triggering increases the risk of unintended actions, mis-targeted replies, or acting on incomplete context, especially because later steps include posting to X via CLI.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script performs automatic gateway restarts based solely on observed flap counts, without requiring user confirmation or a stronger operator-facing approval step. In the context of a skill advertised for X reply handling, autonomous destructive operational actions are especially dangerous because they can disrupt availability and surprise operators.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code sends mention text and conversation context to the Gemini API, including content from other users' tweets, without any explicit consent, minimization, or disclosure mechanism. In a social-thread responder, this is more dangerous because the tool aggregates third-party conversation data and transmits it to an external model provider, potentially exposing sensitive or private contextual information.

Ssd 1

High

• Confidence: 98% confidence
• Finding: User-controlled tweet text and fetched context are interpolated directly into the prompt as trusted natural language, so an attacker can include instructions that manipulate the model into generating harmful, spammy, policy-violating, or reputation-damaging replies. Because the system autonomously posts the model output to X with no approval step or robust safety filter, prompt injection can directly influence public actions.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/awareness.js:111

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/reply-bot.js:136