Twitter/X舆论采集

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:02 AM UTC
• Version: 3.6.1

Overview

This Twitter/X data lookup skill is not overtly malicious, but its platform scope and shell-based API calling instructions need review before installation.

Review this skill before installing. Use it only if you are comfortable sending Twitter/X search terms, handles, tweet IDs, and your MaxHub API key to aconfig.cn. Prefer a pinned install version, avoid sensitive queries, and ensure the agent constructs HTTP requests with encoded parameters and documented Twitter endpoints only.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:13

Finding

Unpinned Third-Party Package and Skill Installation

Content

View full analysis

Remediation

View remediation

install maxhub-twitter@3.6.1 ``` 2. If the Skill installer does not support version-qualified Skill names, add an explicit version-locking or digest-verification feature before recommending it. 3. Publish and verify cryptographic integrity information for the Skill artifact. 4. Use a lockfile and an explicitly configured trusted registry for package resolution. 5. Where supported, disable package lifecycle scripts during installation. 6. Document the expected package publisher, version, artifact digest, and verification procedure. 7. Review each new CLI or Skill version before updating the pinned installation command. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:45

Finding

Unsafe Shell-Based Construction of Authenticated API Requests

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The top-level metadata describes the skill as a Twitter/X-only assistant, yet the body includes routing and fallback behavior for Douyin and Xiaohongshu APIs. This inconsistency is dangerous because it obscures the real operational scope and may cause users or host systems to send data to services they did not intend to use.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

| 禁止行为 | 正确做法 |
|----------|----------|
| ❌ 自行拼接路径（如 `/api/v1/douyin/search/xxx`） | ✅ 使用 Action Table 或 `<!-- Full path: -->` 中的路径 |
| ❌ 猜测参数名（如把 `aweme_id` 写成 `video_id`） | ✅ 使用 Action Table 或 reference 文件中的参数名 |
| ❌ 假设 v1/v2/v3 参数兼容 | ✅ 降级时重新读取对应版本的参数文档 |
| ❌ 调用 `fetch_hot_search_list` 或 `app/v3/fetch_video_comments` | ✅ 使用替代端点（见废弃标注） |

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

| 禁止行为 | 正确做法 |
|----------|----------|
| ❌ 自行拼接路径(如 `/api/v1/douyin/search/xxx`) | ✅ 使用 Action Table 或 `<!-- Full path: -->` 中的路径 |
| ❌ 猜测参数名(如把 `aweme_id` 写成 `video_id`) | ✅ 使用 Action Table 或 reference 文件中的参数名 |
| ❌ 假设 v1/v2/v3 参数兼容 | ✅ 降级时重新读取对应版本的参数文档 |
| ❌ 调用 `fetch_hot_search_list` 或 `app/v3/fetch_video_comments` | ✅ 使用替代端点(见废弃标注) |

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill’s security declaration asserts Twitter/X-only, read-only behavior, but other sections reference Douyin/Xiaohongshu paths and downgrade logic. This mismatch can mislead reviewers and users about actual data flows and platform scope, weakening trust and potentially masking unintended cross-platform requests.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md

| "analyze" / "分析一下" | Switch to analyze mode |
| "compare with X" / "和X对比" | Add X as second query |

## Output Guidelines

1. **Language consistency** — ALL output matches user's detected language.
2. **Markdown links** — All URLs in `[text](url)` format.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-search-trending.md (reported line 11)May include surrounding context.

md

`GET /api/v1/twitter/web/fetch_search_timeline`

<!-- Full path: /api/v1/twitter/web/fetch_search_timeline -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-tweet.md (reported line 11)May include surrounding context.

md

`GET /api/v1/twitter/web/fetch_latest_post_comments`

<!-- Full path: /api/v1/twitter/web/fetch_latest_post_comments -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-tweet.md (reported line 38)May include surrounding context.

md

`GET /api/v1/twitter/web/fetch_post_comments`

<!-- Full path: /api/v1/twitter/web/fetch_post_comments -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-tweet.md (reported line 65)May include surrounding context.

md

`GET /api/v1/twitter/web/fetch_retweet_user_list`

<!-- Full path: /api/v1/twitter/web/fetch_retweet_user_list -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-tweet.md (reported line 121)May include surrounding context.

md

`GET /api/v1/twitter/web/fetch_user_followers`

<!-- Full path: /api/v1/twitter/web/fetch_user_followers -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-tweet.md (reported line 179)May include surrounding context.

md

`GET /api/v1/twitter/web/fetch_user_media`

<!-- Full path: /api/v1/twitter/web/fetch_user_media -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-tweet.md (reported line 241)May include surrounding context.

md

`GET /api/v1/twitter/web/fetch_user_profile`

<!-- Full path: /api/v1/twitter/web/fetch_user_profile -->

### Parameters

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The installation command uses npx clawhub without pinning a specific version, so users will execute whatever version is current at install time. If the package is compromised, a malicious release is published, or a breaking update is introduced, this can lead to arbitrary code execution or supply-chain compromise on the user's machine.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The usage table lists very short trigger examples such as "推文", "详情", "用户", "资料", "搜索", and "趋势" without clarifying activation boundaries or required context. These generic terms overlap with common conversation and do not specify when the skill should or should not activate, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to run npx clawhub install maxhub-twitter without pinning a specific version of the package. This creates a supply-chain risk because future or compromised versions of the installer tool could be fetched and executed implicitly, and README-driven install commands are commonly copied verbatim by users.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example trigger words are extremely broad (推文, 详情, 用户, 资料, 搜索, 趋势) and overlap with normal conversational language. In an agent environment, this can cause accidental invocation of the skill on unrelated user input, leading to unintended external API calls, privacy leakage of prompts, or confusing tool behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill tells users to query a third-party API but does not clearly warn that user prompts, search targets, and related identifiers may be transmitted off-platform. This creates a transparency and privacy risk, especially for sensitive investigations, monitoring queries, or personal identifiers.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The file instructs the assistant to determine the user's language from the first message and maintain that language throughout the conversation, and later states that all output must match the detected language. This is a language-policy constraint based on detection rather than explicit user choice, which can conflict with organizational requirements to let users choose their preferred language or locale.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The documented behavior explicitly sends user-supplied parameters and an authorization credential to an external domain. External transmission is expected for an API skill, but it remains security-relevant because queries, targets, and metadata may leave the host environment and be processed by a third party.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

maxhub_auth_header="Authorization: Bearer ${MAXHUB_API_KEY}"

# GET example
curl -s "https://www.aconfig.cn/api/v1/twitter/{endpoint}?{params}" \
  -H "$maxhub_auth_header"

# POST example

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger phrases are broad and overlapping, with defaults like 'if uncertain, default to Tweet Data,' which increases the chance of misrouting user intent. In a skill that can transmit user queries externally, unintended invocation can expose data or produce actions against the wrong endpoint set.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation describes sending user-provided search keywords to an external service at aconfig.cn using bearer-authenticated requests, but it does not warn operators that their queries and related metadata leave the local trust boundary. In a search skill, this creates a real privacy and consent risk because users may supply sensitive names, topics, or investigation terms that are then transmitted to a third party under the integrator's API credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation instructs users to send a Bearer API key and user-supplied Twitter identifiers to https://www.aconfig.cn, a third-party service, without any warning about external data transfer, trust boundaries, retention, or privacy implications. In an agent-skill context, this can cause operators or downstream agents to unknowingly exfiltrate authentication material and queried identifiers to an outside provider.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The file presents headings and parameter descriptions bilingually but the detailed usage sections are primarily in Chinese, with no statement about supported language options or intended locale. This can amount to a language-policy issue when a skill effectively assumes a language without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The file presents headings, parameter descriptions, and usage text in a mixed Chinese/English format, but it does not tell users whether they can choose their preferred language or whether Chinese is required for a specific audience. Under the language/locale policy rule, forcing or assuming a locale without opt-in can be a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The document consistently presents parameter descriptions in Chinese/English form, indicating a fixed language/locale format for the skill reference. There is no visible opt-in, user language selection, or justification that this skill is specifically intended for a bilingual or Chinese-focused audience.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.