X Auto-Tweet (Browser)

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:46 AM UTC
• Version: 1.0.0

Overview

This skill appears to do what it advertises, but it can control a logged-in X account and publish posts with weak safeguards.

Install only if you are comfortable letting local automation act through a logged-in X account. Use a dedicated browser profile or test account, keep per-post approval enabled, avoid cron or full-auto mode unless you add strict limits and a kill switch, review local queue and history files, and do not rely on the skill's 'credential-free' or Terms-of-Service claims as security guarantees.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The documentation is misleading: the skill is not truly credential-free because it relies on an authenticated, persisted X browser session tied to the user's account. That session is sensitive and grants the automation the ability to read personalized content and post on the user's behalf, so claiming 'no private data' understates real account and privacy risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The quick-start explicitly instructs the user to run a posting script against their authenticated X session, but it does not clearly foreground that this action will publish content from the user's own account and can affect account reputation, policy standing, and account integrity. In the context of browser-session-based automation, a user may underestimate that they are granting local code the ability to act as them on a live account.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document states that the automation uses the user's logged-in browser session for scraping and posting, but provides only minimal caution and does not adequately warn about the security and privacy implications of reusing an authenticated session. Any script that operates through an active browser session can act with the same privileges as the user, exposing account actions, session-derived data, and potential policy or abuse risks.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly promotes attaching to a logged-in browser session, scraping, and automated posting while emphasizing bypassing the official API and limits. That creates meaningful privacy, account-security, and platform-abuse risk, yet the documentation does not clearly warn that browser-session automation can access authenticated data and perform actions as the user. In this context, the missing warning is dangerous because users may underestimate that the skill effectively inherits full account privileges from the live session.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The cron workflow describes recurring monitoring of X activity and forwarding generated content to Telegram, but it does not clearly disclose that this enables ongoing surveillance-like behavior and transmits data to a third party. That omission is risky because users may deploy persistent automation without understanding the privacy implications, retention concerns, or the chance of sending sensitive account-derived content outside the local environment.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill description presents browser automation as a cost-saving substitute for the API but does not prominently warn that it will operate through the user's authenticated X account. That omission can cause users to underestimate risks such as unintended posting, account compromise through session misuse, and platform enforcement or suspension for automated behavior.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill states it scrapes the user's personalized 'For You' feed and saves extracted trends to local JSON, but it does not provide a clear privacy warning about storing account-tailored behavioral data on disk. Because personalized feeds can reflect user interests and account context, silent collection and retention increases privacy and data handling risk.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill uses broad, natural-language commands like "Check X trends and generate tweet ideas" that can be triggered by ordinary conversation rather than a narrowly scoped command interface. In an agent setting, this increases the risk of unintended invocation of browsing, content generation, and posting-related workflow steps from ambiguous user messages or quoted text.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The example commands in this section are overly generic (for example, requests to check trends, generate tweets, post text, or show history) and lack strict trigger boundaries. If an agent interprets these examples operationally, benign conversation, copied text, or prompt injection could cause unintended access to external services or posting workflows.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The script intentionally introduces randomized delays specifically to 'look human' while automating posts to X, which is a classic evasion pattern for avoiding platform bot detection and disguising automation as organic user behavior. In the context of a social-posting skill that connects to a live browser session and publishes queued content automatically, this increases abuse potential for stealthy spam, sockpuppeting, or policy-evasion campaigns.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Safety Features

- **No auto-posting without approval** (unless you configure it)
- **Human-like delays** (30-60s between tweets)
- **Daily limits** (configurable, default 10/day)
- **Queue review** before posting

• Confidence: 90% confidence
• Finding: without approval

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## ⚠️ Safety Features

- **No auto-posting without approval** (except if you whitelist it)
- **Daily tweet limit:** Max 10 tweets/day (avoid spam)
- **Human-like delays:** 30-60 sec between tweets
- **Content review:** All tweets shown to you first

• Confidence: 90% confidence
• Finding: without approval

Session Persistence

Medium

• Category: Rogue Agent

Content

- [ ] Test trend scraping
- [ ] Test posting
- [ ] Build auto-tweet flow
- [ ] Add cron job for automation
- [ ] Monitor mentions
- [ ] Strategic liking/RTing

• Confidence: 82% confidence
• Finding: Add cron job for

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"auto": "node scripts/auto-tweet.js"
  },
  "dependencies": {
    "playwright": "^1.40.0"
  },
  "author": "",
  "license": "MIT"

• Confidence: 91% confidence
• Finding: "playwright": "^1.40.0"

Known Vulnerable Dependency: playwright==1.40.0 — 1 advisory(ies): CVE-2025-59288 (Playwright downloads and installs browsers without verifying the authenticity of)

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: playwright==1.40.0

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.