Security audit
Security checks for vulnerabilities and agentic risk
This skill is mostly a real X posting client, but its declared scope conflicts with implemented search, mentions, and automation behavior for a live social account.
Review this before installing. Use a dedicated X app or low-risk account, keep the OAuth tokens private, and do not let an agent run posting, deletion, mentions, search, or automation commands unless you explicitly intend those live account actions. Treat delete as irreversible and review generated tweet content before running the automation template.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
3. Generate OAuth 1.0a keys:
- Consumer Key (API Key)
- Consumer Secret (API Secret)
- Access Token
- Access Token Secret
### 2. Set Environment Variables
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
3. Generate OAuth 1.0a keys:
- Consumer Key (API Key)
- Consumer Secret (API Secret)
- Access Token
- Access Token Secret
### 2. Set Environment Variables
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
3. Generate OAuth 1.0a keys:
- Consumer Key (API Key)
- Consumer Secret (API Secret)
- Access Token
- Access Token Secret
### 2. Set Environment Variables
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
3. Generate OAuth 1.0a keys:
- Consumer Key (API Key)
- Consumer Secret (API Secret)
- Access Token
- Access Token Secret
### 2. Set Environment Variables
The README advertises mentions and search commands even though the skill metadata explicitly says the skill is not for search or mentions. This mismatch can cause users or upstream agents to invoke capabilities outside the declared scope, undermining trust boundaries, policy enforcement, and safe tool selection.
The manifest says the skill is not for search, mentions, or media uploads, but the body advertises commands for mentions, search, and media attachment. This mismatch can cause an agent or user to invoke capabilities that exceed the stated trust boundary, leading to unintended data access or policy bypass.
The manifest says the skill is not for search, mentions, or media uploads, but the body advertises commands for mentions, search, and media attachment. This mismatch can cause an agent or user to invoke capabilities that exceed the stated trust boundary, leading to unintended data access or policy bypass.
The manifest explicitly says the skill is not for search, mentions, or media uploads, yet the documentation instructs users to use mentions, search, and media-post features. Such self-contradiction is dangerous because security decisions often rely on the manifest summary, while the operational text encourages broader, potentially privacy-impacting actions.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- **"Unauthorized" after credential rotation** — X API keys are invalidated when you regenerate them in the Developer Portal. All 4 env vars must be updated together (`X_API_KEY`, `X_API_SECRET`, `X_ACCESS_TOKEN`, `X_ACCESS_TOKEN_SECRET`).
- **Trailing newlines in env vars break auth** — If you copy/paste credentials and include a trailing `\n`, OAuth signing will fail silently with a 401. Always verify with `echo -n "$X_API_KEY" | xxd` to confirm no whitespace.
- **Rate limit 429s are per-endpoint** — Hitting the limit on `POST /2/tweets` doesn't affect `GET /2/users`. Each endpoint has its own 15-minute window. Back off only the failing endpoint.
- **App write permissions must be set before generating tokens** — If you generate access tokens before enabling "Read and Write" in the Developer Portal, the tokens will be read-only. Regenerate tokens after changing permissions.
The manifest says the skill is not for mentions, yet the implementation includes a mentions command that retrieves the authenticated user's mention timeline. This hidden capability undermines trust boundaries and can expose account-related data or enable agent behavior beyond what reviewers, users, or policy systems expect from the skill description.
The skill metadata explicitly says it is not for search, but the code exposes a functional search command that performs tweet searches via the X API. This is a capability mismatch that can bypass policy or operator expectations, causing the agent to perform actions outside its declared scope and potentially access data or paid-tier endpoints the user did not authorize in the skill definition.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
console.log(` Following: ${user.public_metrics.following_count || 0}`);
console.log(` Tweets: ${user.public_metrics.tweet_count || 0}`);
}
console.log(`\n X_USER_ID=${user.id} (add this to your .env for faster mentions)`);
} catch (error) {
console.error('❌ Failed to fetch account info:', error.message);
process.exit(1);
The README documents public account-affecting actions such as posting, threading, deletion, and automation templates without an explicit warning that these actions are irreversible or publicly visible on the user's account. In agentic contexts, missing safety disclosure increases the risk of accidental unauthorized or surprising actions triggered by ambiguous user prompts or automation.
The skill declares required environment-variable access but does not define an explicit tool scope or permission boundary. That weakens least-privilege controls and makes it easier for a runtime or agent to grant broader access than users may expect, especially since the skill operates with live social-media credentials.
The overview presents mentions and search as available use cases while later text states these require a higher X API tier. This inconsistency can mislead agents into attempting unsupported calls, causing failed actions, noisy retries, or accidental exposure of account-linked identifiers when checking mentions.
The documentation advertises media posting via a --media option despite also stating media uploads are unsupported or require a higher tier. This can prompt users or agents to attempt operations the skill cannot safely or correctly perform, increasing the chance of unexpected behavior or insecure workarounds.
The skill documents tweet deletion without any warning, dry-run mode, or confirmation guidance. Because deletion is destructive and operates against a live account, an agent misunderstanding or prompt injection could irreversibly remove content the user did not intend to delete.
The file implements an automated posting template with daily limits and cooldowns, which materially differs from the manifest’s description of a user-invoked helper for posting and account actions. This mismatch is dangerous because users or orchestrators may grant the skill broader trust than intended, causing unattended social-media actions and policy/compliance issues.
The manifest claims the skill should be used to create threads, delete tweets, and check account info. This script only generates one post string and calls a post action; there is no code path for thread creation, deletion, or account-information retrieval in this file.
The dependency uses a caret range, which allows newer minor/patch releases to be installed without explicit review. This increases supply-chain risk because a compromised upstream release or breaking change could be pulled into the skill automatically, which is relevant here because the package handles OAuth-based posting to a social-media account.
"author": "",
"license": "MIT",
"dependencies": {
"twitter-api-v2": "^1.15.0",
"commander": "^11.1.0",
"dotenv": "^16.3.1"
},
The commander package is specified with a caret range, so future compatible releases may be installed implicitly. While this is common in JavaScript projects, it still creates a low-severity supply-chain exposure if an upstream package release is malicious or unexpectedly changes CLI argument handling.
"license": "MIT",
"dependencies": {
"twitter-api-v2": "^1.15.0",
"commander": "^11.1.0",
"dotenv": "^16.3.1"
},
"engines": {
The dotenv dependency is not pinned exactly, allowing unreviewed patch/minor updates to be resolved at install time. In a skill that likely loads API credentials from environment files, any supply-chain compromise in this package could affect secret handling or execution flow.
"dependencies": {
"twitter-api-v2": "^1.15.0",
"commander": "^11.1.0",
"dotenv": "^16.3.1"
},
"engines": {
"node": ">=16.0.0"
Detected: suspicious.exposed_secret_literal