X Tweet Monitor

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:34 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but it handles live X/Twitter session cookies in a risky, under-documented way and runs a continuous monitor that sends tweet content to Telegram.

Review this before installing. Use only a dedicated or low-risk X/Twitter session, avoid running it on shared machines, treat AUTH_TOKEN, CT0, and Telegram bot tokens as secrets, and rotate them if exposed. Confirm the xreach binary source before use, and expect monitored account names and tweet text to be sent to the configured Telegram chat while the script is running.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: x_tweet_monitor.py:15

Finding

Twitter Session Credentials Exposed Through Process Arguments

Content

View full analysis

Vulnerability Details

File Location: x_tweet_monitor.py, line 15
Vulnerability Type: Sensitive credentials exposed in subprocess arguments
Risk Level: Medium

Vulnerable Code

python

r = subprocess.run(["xreach","tweets",f"@{U}","-n","10","--auth-token",A,"--ct0",C,"--json"],capture_output=True,text=True,timeout=30)

Technical Analysis

The code passes the sensitive AUTH_TOKEN and CT0 Twitter session-cookie values directly in the xreach process argument vector. While the child process is running, operating-system interfaces and process-monitoring tools may expose its command line. For example, depending on the host's process-inspection permissions, the arguments may be accessible through /proc/<pid>/cmdline, ps, or equivalent monitoring facilities.

The code avoids shell interpretation by supplying an argument list, so this is not a shell-command injection vulnerability. The issue is specifically the disclosure of authentication secrets through an observable process argument vector.

Attack Path

1. The victim configures valid AUTH_TOKEN and CT0 values and starts the monitor.
2. During each polling cycle, the application launches xreach with both secrets in its process arguments.
3. A local user or compromised process with sufficient process-inspection access reads the xreach command line while it is running.
4. The attacker extracts the session-cookie values.
5. The attacker reuses the credentials to make authenticated requests to X within the permissions and lifetime of the captured session.

Exploitation requires local access or another foothold capable of observing the child process's arguments.

Impact Assessment

Successful exploitation can disclose the configured X session credentials. An attacker may impersonate the authenticated session and access account data or perform actions allowed by those credentials. The precise scope depends on X's session cont ...[truncated 183 chars]

Remediation

View remediation

Remediation Suggestions

• Do not pass authentication secrets through command-line arguments.
• If supported by xreach, provide credentials through standard input, inherited environment variables, or a permission-restricted credential file.
• If a credential file is required, create it with owner-only permissions, avoid predictable shared temporary paths, and remove it promptly after use.
• Restrict process-inspection capabilities on the host using appropriate operating-system controls.
• Run the monitor under a dedicated, least-privileged service account.
• Rotate the Twitter session credentials after any suspected exposure and revoke obsolete sessions.
• Document and pin a trusted source and version of the external xreach dependency.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares capabilities that imply access to environment variables, network connectivity, and shell execution, but it does not specify any explicit tool scope or permission boundaries. In an agent setting, this increases the risk of overbroad execution and unintended access to secrets or external services, especially because the skill is designed to handle authentication tokens and send network requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup instructions require highly sensitive credentials, including Twitter session cookies and Telegram bot tokens, but provide no warning about secure storage, least-privilege handling, or the privacy risks of using live account credentials. This can lead users to expose reusable authentication material in insecure environments, logs, shell history, or shared agent contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The script accesses sensitive environment variables for X/Twitter and Telegram authentication and later uses them in subprocess and network operations, but the file provides no warning or explanatory comment about handling credentials. Under the code-file criteria, access to sensitive credentials should have some visible disclosure unless already clearly documented.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · x_tweet_monitor.py (reported line 15)May include surrounding context.

python

def get():
    if not A or not C: return None
    r = subprocess.run(["xreach","tweets",f"@{U}","-n","10","--auth-token",A,"--ct0",C,"--json"],capture_output=True,text=True,timeout=30)
    try: return json.loads(r.stdout).get("items")
    except: return None

Tainted flow: 'A' from os.getenv (line 6, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · x_tweet_monitor.py (reported line 15)May include surrounding context.

python

def get():
    if not A or not C: return None
    r = subprocess.run(["xreach","tweets",f"@{U}","-n","10","--auth-token",A,"--ct0",C,"--json"],capture_output=True,text=True,timeout=30)
    try: return json.loads(r.stdout).get("items")
    except: return None

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · x_tweet_monitor.py (reported line 23)May include surrounding context.

python

if not TB or not TC: return
    import aiohttp
    async with aiohttp.ClientSession() as s:
        await s.post(f"https://api.telegram.org/bot{TB}/sendMessage",json={"chat_id":TC,"text":m})

async def main():
    log(f"Started: @{U}")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code posts data to the Telegram Bot API, including the monitored username and tweet text, but there is no confirmation prompt, warning comment/docstring, or user-facing disclosure describing that external transmission. Because the operation transmits user/system-derived content off-host, it falls under the code-file warning requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The setup instructions switch to Chinese for core usage details, which imposes a specific language on users without opt-in or explanation. The stated policy requires flagging language or locale restrictions unless the skill offers a choice or clearly documents a justified regional constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill emits Chinese user-facing messages such as "启动" and "新推文" with no language selection or opt-in mechanism. That creates a locale/language policy issue because the skill forces a specific language for notifications regardless of user preference.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.