Security audit
Security checks for vulnerabilities and agentic risk
This skill is a narrow, disclosed helper for fetching public X/Twitter post data through fxTwitter.
Install only if you are comfortable sending requested X/Twitter post IDs to the third-party fxTwitter API. Avoid using it for private or sensitive links, and expect the returned data to include public tweet metadata such as author, media, and engagement stats.
The skill performs network access to a third-party API but does not declare any explicit tool scope or permissions boundary. That increases the chance of unintended external requests or overly broad runtime access, reducing reviewability and making it harder to enforce least privilege.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
return None
def fetch_tweet(tweet_id):
url = f"https://api.fxtwitter.com/{tweet_id}"
req = urllib.request.Request(url, headers={"User-Agent": "fxtwitter-skill/1.0"})
with urllib.request.urlopen(req) as resp:
return json.loads(resp.read())
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
return None
def fetch_tweet(tweet_id):
url = f"https://api.fxtwitter.com/{tweet_id}"
req = urllib.request.Request(url, headers={"User-Agent": "fxtwitter-skill/1.0"})
with urllib.request.urlopen(req) as resp:
return json.loads(resp.read())
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
return None
def fetch_tweet(tweet_id):
url = f"https://api.fxtwitter.com/{tweet_id}"
req = urllib.request.Request(url, headers={"User-Agent": "fxtwitter-skill/1.0"})
with urllib.request.urlopen(req) as resp:
return json.loads(resp.read())