Security audit

Tweet Humanizer

Security checks for vulnerabilities and agentic risk

Overview

This is a text-only tweet editing skill with no executable payload, but its metadata is inconsistent about network access and Ollama use.

Reasonable to install for manual tweet editing, but review the metadata first: it should ideally have one authoritative front matter block and should not request general outbound network access unless the Ollama/local model behavior is clearly documented and scoped.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Note

Location: SKILL.md:1
Finding: Conflicting Metadata Grants Unnecessary Outbound Network Access
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The commented documentation states that Sara owns the insight-to-social and blog-to-social pipelines and that tweet-humanizer is not a pipeline step. This conflicts with the active manifest description, which presents the skill as a post-draft QA pass to use after another agent drafts tweet content.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.