youmind-x-article

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:59 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches an X posting assistant, but it also exposes under-disclosed deletion, local-file upload, and credential-bearing network behavior that should be reviewed before install.

Install only if you are comfortable giving the skill a YouMind API key that can publish through a connected X account. Before use, review or remove the delete command, keep `youmind.base_url` fixed to the official YouMind HTTPS endpoint, avoid passing local image paths, require explicit confirmation for every publish/delete action, and prefer a reviewed lockfile-based install.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:53

Finding

Mandatory onboarding instructions override the active conversation goal

Content

View full analysis

**AI X Post Writer installed!** > > Tell me your topic and I'll write and publish a tweet for you. > > **Try it now:** "Write a tweet about the future of open source AI" > > **What it does:** > - Research topics from your YouMind knowledge base and web trends > - Write tweets optimized for engagement within 280 characters > - Split long content into numbered tweet sequences (1/N format) > - Publish directly to X through the X account connected in YouMind > > **Setup (one-time):** > 1. Install & configure: `cd toolkit && npm install && npm run build && cd .. && mkdir -p ~/.youmind/config && cp shared/config.example.yaml ~/.youmind/config.yaml` > 2. Get [YouMind API Key](https://youmind.com/settings/api-keys?utm_source=youmind-x-article) and fill `youmind.api_key` in `~/.youmind/config.yaml` > 3. Connect your X account inside YouMind before publishing. This skill no longer reads X developer keys locally. > 4. Publishing requires a paid YouMind plan (Pro / Max) and consumes YouMind credits per tweet. > > No X connection yet, or on a free plan? You can still write and preview locally — just skip the publish step. > > **Need help?** Just ask! ``` ### Technical Analysis The skill directs the agent to emit a predetermined onboarding and promotional response immediately when an installation condition is met. The use of `MANDATORY` and `IMMEDIATELY` attempts to supersede the user's active request rather than making onboarding conditional on user intent. The fixed response also promotes external YouMind pages, paid plans, credential setup, and dependency installation. This is a session-level instruction override: loading ...[truncated 892 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: toolkit/src/config.ts:70

Finding

API key and sensitive request content can be transmitted to an unrestricted configured host

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: toolkit/src/publisher.ts:83

Finding

Unrestricted local image paths permit arbitrary file transmission and memory exhaustion

Content

View full analysis

', 'Local image paths or cdn.gooo.ai URLs (max 4)') ``` ### Technical Analysis The media preparation logic accepts arbitrary relative or absolute paths and resolves them against the process working directory. It checks only whether the path exists, refers to a file, and has an allowed filename extension. It does not: - Restrict reads to a user-approved media directory. - Reject symbolic links. - Verify file signatures or actual MIME types. - Enforce a maximum file size. - Confirm that the selected file will be transmitted. - Limit the number of inputs in implementation code. - Stream the data with bounded memory usage. The entire file is synchronously loaded into memory and Base64-encoded before being sent over the network. Any accessible file with an accepted extension, or a symbolic link named with suc ...[truncated 1509 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: toolkit/src/cli.ts:229

Finding

Undocumented destructive tweet deletion is exposed through a broadly permitted CLI

Content

View full analysis

', 'Tweet ID') .option('-y, --yes', 'Skip confirmation prompt') .action(async (postId: string, opts) => { const config = loadXConfig(); if (!config.apiKey) { console.error('[ERROR] youmind.api_key not set. Configure ~/.youmind/config.yaml.'); process.exit(1); } if (!opts.yes) { console.error(`Refusing to delete ${postId} without --yes. Re-run with -y to confirm.`); process.exit(1); } try { const result = await deleteXPost(config, postId); if (!result.ok) { console.error(`Delete returned ok=false for ${result.postId}.`); process.exit(1); } console.log(`Deleted tweet ${result.postId}.`); } catch (err) { console.error(`Delete failed: ${(err as Error).message}`); process.exit(1); } }); ``` The network operation is implemented as follows: ```ts export async function deleteXPost( config: XConfig, postId: string, ): Promise { const data = await callPublishing>( 'deletePost', { platform: 'x', postId }, config, ); return { ok: Boolean(data.ok ?? true), postId: String(data.postId ?? data.post_id ?? postId), }; } ``` ### Technical Analysis The skill's declared purpose is writing and publishing tweets and threads. Its API documentation states at `references/api-reference.md:68` that tweet deletion is not supported, yet the executable CLI contains a deletion command. The command permits confirmation to be bypassed with `--yes`. Because the skill grants a broad executable pattern—`Bash(node dist/cli.js *)`—an agent can invoke the destructive operation using the same authori ...[truncated 1026 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: toolkit/package.json:18

Finding

Dependency installation is not reproducibly locked or integrity pinned

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (86)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Most of the code aligns with the declared purpose: it supports tweeting, thread publishing, previewing content, and using a connected X account via YouMind. However, it also exposes a material undeclared capability: deleting tweets by ID (delete command). That is a privileged action not mentioned in the description or triggers. Additionally, parts of the declared description—topic research via YouMind knowledge base and AI-assisted optimized writing—are not visible in this code chunk; the CLI mainly accepts provided text/file input and forwards it for preview/publish. The strongest mismatch is the undeclared delete functionality, so this should be flagged as a description/behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code chunk is purely configuration management: it reads ~/.youmind/config.yaml and a skill-specific override file, merges values, and returns YouMind API connection settings. That is only a supporting utility and does not implement the declared end-user functionality. Because the declared purpose emphasizes writing and publishing tweets to X with AI, while the actual code shown performs only config loading for YouMind access, the description does not accurately represent this code chunk's behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied code is a local content-formatting/adaptation module, not a full tweet publishing skill. It prepares text to fit X constraints, including single tweets, threads, and long-form posts, but does not perform research, generate content with AI, or publish anything to X/Twitter. The declared description emphasizes end-to-end creation and one-click publishing via connected accounts, which is not represented in this code chunk. While thread writing support is partially reflected through formatting/splitting logic, the primary declared capabilities are materially broader than the actual behavior shown.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The code generally aligns with the publishing-to-X portion of the description, including posting tweets and supporting thread construction via replyToPostId. However, the description overstates several capabilities that are not present in this code chunk: there is no topic research against a knowledge base, no AI text generation or optimization, and no numbering/thread-writing logic. More importantly for mismatch detection, the code also exposes an undeclared destructive capability: deleting X posts via deleteXPost. That is a materially different capability from simply writing/publishing tweets, so this should be flagged as a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description centers on generating and publishing tweets to X/Twitter. However, the supplied code only interacts with YouMind APIs: semantic search, web search, board/material/craft listing and retrieval, markdown article saving, topic mining, and chat-based image generation. There is no code for X authentication, tweet creation, thread assembly, post scheduling, or publishing. Topic research via YouMind is partially consistent as a supporting piece, but the main promised capability—writing/publishing tweets—is absent, while several unrelated capabilities are present. This is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 101)May include surrounding context.

md

Base URL: `https://youmind.com/openapi/v1`

All X publishing flows through YouMind's OpenAPI proxy. The caller only sends a YouMind API key in `x-api-key`. The user's X access token and refresh token are stored inside YouMind (connected once via OAuth 2.0 PKCE in the YouMind product) and never placed in the skill config.

## Authentication

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README_CN.md (reported line 101)May include surrounding context.

md

Base URL: `https://youmind.com/openapi/v1`

All X publishing flows through YouMind's OpenAPI proxy. The caller only sends a YouMind API key in `x-api-key`. The user's X access token and refresh token are stored inside YouMind (connected once via OAuth 2.0 PKCE in the YouMind product) and never placed in the skill config.

## Authentication

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-reference.md (reported line 5)May include surrounding context.

md

Base URL: `https://youmind.com/openapi/v1`

All X publishing flows through YouMind's OpenAPI proxy. The caller only sends a YouMind API key in `x-api-key`. The user's X access token and refresh token are stored inside YouMind (connected once via OAuth 2.0 PKCE in the YouMind product) and never placed in the skill config.

## Authentication

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-reference.md (reported line 80)May include surrounding context.

md

| Status | Meaning |
|--------|---------|
| 400 | X rejected the request (e.g., duplicate tweet, media URL not under cdn.gooo.ai, invalid `replyToPostId`) |
| 401 | Invalid or missing YouMind API key, or X access token revoked (YouMind clears the stored credentials in this case) |
| 402 | Current YouMind plan is not eligible for dispatch OpenAPI — upgrade link is in the response |
| 402 (credits) | `InsufficientCreditsException` — YouMind credit balance is below the tweet cost |
| 403 | X forbids this action (account suspended, app quota exceeded) |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · shared/YOUMIND_HOME.md (reported line 34)May include surrounding context.

md

1. `~/.youmind/config/<skill>.yaml`
2. `~/.youmind/config.yaml`

This is now a hard requirement. Article skills do **not** read repo-local `config.yaml` files or `~/.youmind-skill/credentials.yaml` anymore.

## Canonical Files

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · shared/YOUMIND_HOME.md (reported line 46)May include surrounding context.

md

1. `~/.youmind/config/<skill>.yaml`
2. `~/.youmind/config.yaml`

This is now a hard requirement. Article skills do **not** read repo-local `config.yaml` files or `~/.youmind-skill/credentials.yaml` anymore.

## Canonical Files

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

This module makes outbound network requests to the YouMind publishing API via fetch, but the skill metadata provided does not declare corresponding network permission coverage. Hidden or undeclared network capability is risky because it can transmit user content, media, and authentication-backed actions to external services without a clear permission boundary or user review. In a posting skill, network access is expected functionally, but it still must be explicitly declared and constrained.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module exposes content-management behavior (saveArticle) that goes beyond the declared X/Twitter posting purpose, creating a capability mismatch between what the skill claims to do and what it can do. In an agent setting, hidden or unnecessary write-capable features increase the chance of unintended data exfiltration or unauthorized remote content creation, especially when local file content can later be uploaded through adjacent CLI paths.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The chat-based image generation flow introduces an undisclosed remote AI-chat capability unrelated to the stated X-posting function. This broadens the trust boundary by sending arbitrary prompts to a backend agent mode and polling tool outputs, which can surprise users, increase data-sharing risk, and create an avenue for unintended external actions in a skill that should be narrowly scoped.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

1. Install dependencies

cd toolkit && npm install && npm run build && cd ..

2. Create shared config (recommended)

mkdir -p ~/.youmind/config cp shared/config.example.yaml ~/.youmind/config.yaml

text

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 43)May include surrounding context.

md

### Publishing prerequisite

Before publishing, connect your X account inside YouMind (one-click OAuth 2.0). This skill no longer reads X Developer Portal credentials locally and should never ask the user to paste X API keys, bearer tokens, or OAuth 1.0a secrets into this repo.

### Get a YouMind API Key

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README_CN.md (reported line 27)May include surrounding context.

cd toolkit && npm install && npm run build && cd ..

2. 创建共享配置

mkdir -p ~/.youmind/config cp shared/config.example.yaml ~/.youmind/config.yaml

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README_CN.md (reported line 27)May include surrounding context.

cd toolkit && npm install && npm run build && cd ..

2. 创建共享配置

mkdir -p ~/.youmind/config cp shared/config.example.yaml ~/.youmind/config.yaml

text

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 78% confidence

Finding

The trigger phrase write thread can collide with generic built-in write functionality and cause this skill to activate in contexts where the user only intended content creation, not X/Twitter workflow. Because this skill is capable of preparing content for external publication, trigger confusion increases the risk of unintended social-post actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger set includes broad everyday phrases like tweet, post on x, and short Chinese phrases that can match ordinary conversation rather than an explicit request to invoke a posting skill. In this skill's context, accidental invocation is more dangerous because the skill can lead to drafting and potentially publishing content to a connected external social-media account.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md

> **AI X Post Writer installed!**
>
> Tell me your topic and I'll write and publish a tweet for you.
>
> **Try it now:** "Write a tweet about the future of open source AI"
>

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence

Finding

The setup instructions invoke npx tsx without pinning a specific package version, which can fetch whatever version is current at execution time. In a supply-chain compromise or malicious package update scenario, users could execute unreviewed code during validation, especially because this skill explicitly tells them to run the command locally.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill instructs writing tweet drafts to ~/.youmind/articles/x/, a shared home directory accessible to all YouMind skills. That creates cross-skill data persistence and potential data exposure or tampering, especially if drafts contain unpublished content, sensitive messaging, or links intended for later posting.

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

md

## Draft Location Rule

**Canonical:** write local tweet Markdown files to `~/.youmind/articles/x/<slug>.md`. This shared home directory is available to all YouMind skills — see [`shared/YOUMIND_HOME.md`](shared/YOUMIND_HOME.md).

**Legacy fallback** (if `~/.youmind/` is not writable): `skills/youmind-x-article/output/<slug>.md`.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.

md

1. **Self-critique**: Pass all checklist items in the playbook's Step 6
2. **Conformance report**: Generate and present to user (Step 7/8)
3. **User approval**: Do not auto-publish without confirmation

### Result Links Rule