Twitter Automation

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:36 AM UTC
• Version: 0.1.5

Overview

This Twitter/X automation skill is purpose-aligned, but it asks users to run a remote shell installer and enables real account-impacting social actions such as posting, deleting, DMs, and follows without strong scoping guidance.

Review before installing. Prefer a manual or pinned CLI install instead of piping a remote script to sh, avoid the optional unpinned npx related-skill commands unless you trust and verify them, and require explicit user confirmation before posting, deleting, DMing, following, liking, or retweeting from a connected X account.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:15

Finding

Unverified Remote Installer Executed Directly by the Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:15-17
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash

# Install CLI
curl -fsSL https://cli.inference.sh | sh && infsh login

Technical Analysis

The installation command downloads a script from https://cli.inference.sh and passes the response directly to sh. The downloaded content is neither displayed for review nor verified against a locally pinned cryptographic digest before execution.

Although the document claims that the installer verifies the downloaded binary's SHA-256 checksum and does not use elevated permissions, the installer itself is remote and is not included in the audited project. Its behavior and checksum-validation implementation therefore cannot be independently verified from the repository. The linked checksum list also does not authenticate the installer before it starts executing.

HTTPS protects the network connection under normal circumstances, but it does not make the payload immutable. Compromise of the hosting service, DNS infrastructure, TLS credentials, deployment pipeline, or service account could cause future invocations of the same command to execute different content.

This behavior exceeds the minimum privilege necessary for installing the declared CLI. The project could instead direct users to download a version-pinned binary, verify it locally, and execute it only after successful verification.

Attack Path

1. An attacker compromises cli.inference.sh, its deployment pipeline, hosting account, DNS configuration, or another trusted distribution component.
2. The attacker replaces or modifies the installation response with a malicious shell script.
3. A user or agent follows the documented Quick Start command.
4. curl retrieves the attacker-controlled response.
5. The pipe forwards the response directly to sh without prior local verification. ...[truncated 751 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | sh installation pattern.
2. Provide version-pinned release URLs rather than a mutable installer endpoint.
3. Require users to download the artifact and its checksum or signature as separate steps.
4. Verify the artifact locally before any execution, and abort installation if verification fails.
5. Prefer asymmetric signature verification with a pinned public key; if SHA-256 is used, publish hashes through an independently protected release channel.
6. Include the installer source in a reviewable repository and pin documentation to a specific reviewed revision.
7. Install into a user-owned directory without sudo, elevated permissions, background services, or changes outside the documented installation scope.
8. Document how users can inspect the downloaded artifact before running it.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:134

Finding

Related Skills Are Installed from Mutable, Unpinned Sources

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:134-145
Vulnerability Type: Insecure third-party dependency and supply-chain usage
Risk Level: Medium

Vulnerable Code:

bash

# Full platform skill (all 150+ apps)
npx skills add inference-sh/skills@inference-sh

# Image generation (create images to post)
npx skills add inference-sh/skills@ai-image-generation

# Video generation (create videos to post)
npx skills add inference-sh/skills@ai-video-generation

# AI avatars (create presenter videos)
npx skills add inference-sh/skills@ai-avatar-video

Technical Analysis

The optional installation examples invoke npx and identify related Skills through mutable names rather than immutable, audited versions or commit hashes. The documentation also does not pin the version and integrity of the skills runner resolved by npx.

Consequently, the content obtained when these commands are run can differ from the content that existed when this Skill was reviewed. A compromised upstream repository, package publication account, release pipeline, dependency, or mutable branch could distribute malicious package logic or hostile Skill instructions.

The risk is conditional because these commands appear under “Related Skills” and are not required for the primary Twitter/X workflow. No evidence in the audited repository proves that the current upstream packages are malicious. The vulnerability is the absence of version and integrity controls at the supply-chain boundary.

Attack Path

1. An attacker compromises the package or repository account associated with the skills runner or one of the referenced Skills.
2. The attacker publishes malicious content under the same mutable package or Skill identifier.
3. A user runs one of the documented npx skills add commands.
4. npx resolves the current upstream runner, and the runner resolves the current Skill content.
5. Installation logic executes or at ...[truncated 826 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the skills runner to an exact reviewed version instead of allowing npx to resolve a mutable latest release.
2. Pin every related Skill to an immutable release identifier or commit hash.
3. Publish and verify integrity hashes or cryptographic signatures for the runner and installed Skill content.
4. Use lockfiles or an equivalent reproducible dependency manifest where supported.
5. Disable package lifecycle scripts unless they are explicitly required and audited.
6. Instruct users to inspect installed Skill files and permission declarations before loading them into an agent.
7. Run optional installation steps in a restricted environment with access limited to the files and credentials necessary for installation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

curl -fsSL https://cli.inference.sh | sh downloads and immediately executes a remote script, which is a high-risk pattern because any compromise of the host, CDN, TLS trust chain, or script content leads directly to arbitrary code execution. Although the note claims checksum verification and limited behavior, the dangerous part is that the bootstrap script itself is executed before independent verification by the user.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

bash

# Install CLI
curl -fsSL https://cli.inference.sh | sh && infsh login

# Post a tweet
infsh app run x/post-tweet --input '{"text": "Hello from inference.sh!"}'

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger list contains broad phrases like social media automation, twitter integration, and post tweet, which can cause the skill to match generic requests. Because this skill can send DMs, follow users, and delete content, overly broad activation increases the chance of unintended account-impacting actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill prominently advertises actions like liking, retweeting, sending DMs, following users, and deleting tweets without nearby warnings that these are real account-impacting operations. In an automation skill, missing warnings materially increases the risk of accidental spam, reputational harm, or unintended destructive actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The skill recommends running npx skills add ... without pinning an exact package version or commit. That allows whatever package version is current at execution time to be fetched and run, creating a supply-chain risk if the package is updated maliciously or unexpectedly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This npx skills add ... example is unpinned and therefore executes code resolved at runtime from the package registry. In a skill file, that is risky because users may copy-paste it and unknowingly run newer or compromised code than the author originally tested.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

Using npx skills add ... without an exact version introduces mutable dependency execution. If the upstream package or dependency chain is compromised, users following this documentation could execute attacker-controlled code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The unpinned npx installation command creates a classic supply-chain exposure because package contents can change over time. The danger is heightened by documentation context, where users are encouraged to run the command directly from a trusted-looking skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description emphasizes posting and engagement but omits clear mention of destructive and read operations that the body documents, such as deleting posts and fetching tweet/user details. This mismatch can mislead users or orchestration systems about the true capability scope of the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.