Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward FxTwitter/X content lookup tool that makes disclosed third-party API requests and does not show hidden persistence, privilege escalation, or destructive behavior.
Install only if you are comfortable sending the X/Twitter post IDs, URLs, or handles you query to FxTwitter. Treat returned content and media URLs as untrusted external data, and avoid using it for sensitive investigations unless that third-party disclosure is acceptable.
The skill documents network access to a third-party API but does not declare any tool scope or permissions boundary. This creates a transparency and governance gap: an agent or user may invoke the skill without an explicit indication that it performs outbound requests.
The skill instructs users to submit tweet URLs, tweet IDs, or usernames to FxTwitter, but it does not clearly warn that these inputs are transmitted to an external third-party service. This can mislead users about data handling and may expose sensitive investigation targets, account lookups, or private workflow context to an external provider.
The embedded Python example performs an outbound request to api.fxtwitter.com using user-supplied tweet identifiers, which is an external data transmission path. In the context of a skill, this is expected functionality, but it still has security relevance because user-provided targets and query metadata are disclosed to a third party and the response content is untrusted external data.
import json
def fetch_tweet(status_id: str) -> dict:
url = f"https://api.fxtwitter.com/2/status/{status_id}"
req = urllib.request.Request(
url,
headers={"User-Agent": "MyBot/1.0"}
The manifest description is written entirely in Chinese ("使用 FxTwitter API 提取 X (Twitter) 文章内容"), which indicates a language-specific presentation without any opt-in, alternative locale, or justification that the skill is region-specific. This can violate language/locale policy when users are not given a choice of language.
The module docstring, usage text, and error/output strings indicate the skill is designed to communicate only in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
The user-facing documentation is written entirely in Chinese, which imposes a specific language on users without any visible opt-in or alternative. Under the stated policy, forcing a language or locale without user choice is a natural-language policy violation unless clearly justified.
文件的名称/描述及全文说明均以中文呈现，没有提供用户可选择语言的说明，也未表明该技能仅面向特定中文区域或合规场景。根据语言/区域政策，若技能强制单一语言而无用户选择或明确正当性，应视为自然语言策略问题。
No suspicious patterns detected.