Wip Xai X Private

• Analyzed: May 11, 2026, 6:59 AM
• Findings: 1
• Version: 1.0.4
• Hash: 77e7339a8427065976c590e0c0772b3b46e6f9a7374e00864b3f3dd295c4fb93
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a legitimate interface for the X (Twitter) API but contains a shell injection vulnerability in auth.mjs. The opRead function uses execSync to call the 1Password CLI with unsanitized input from environment variables (X_OP_VAULT and X_OP_ITEM), which could allow arbitrary command execution if those variables are maliciously crafted. While the intent appears to be credential management, the implementation is insecure.