T08 · Insecure Dependencies
Warning
- Location
SKILL.md:58- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Twitter Autopilot
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed Twitter/X automation skill with real account impact, but its sensitive behavior is mostly purpose-aligned and visible to the user.
Install only for an account where you are comfortable giving an agent read/write Twitter/X authority. Keep `MODE.md` in DRAFT for new or sensitive accounts, review queue entries before running `queue`, avoid cron posting until you trust the workflow, and consider pinning Tweepy in a virtual environment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The documented behavior does not fully match the actions exposed by the skill, including destructive operations like tweet deletion and additional read capabilities. Description-behavior mismatches are dangerous because reviewers may authorize the skill for benign posting while overlooking higher-risk capabilities that can damage an account or leak information.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### 1. Get API Keys 1. Go to [developer.x.com](https://developer.x.com) → create a project + app 2. Set app permissions to **Read and Write** 3. Generate: API Key, API Secret, Access Token, Access Token Secret 4. Generate Bearer Token: `curl -u "API_KEY:API_SECRET" -d "grant_type=client_credentials" "https://api.twitter.com/oauth2/token"` ### 2. Set Environment Variables
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill requests or implies access to environment secrets and writable files, and can perform real-world posting actions, but it does not declare an explicit tool/permission scope. That makes the skill harder to sandbox and review, increasing the chance that an agent can access credentials or modify files beyond what operators expect.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
- Go to developer.x.com → create a project + app
- Set app permissions to Read and Write
- Generate: API Key, API Secret, Access Token, Access Token Secret
- Generate Bearer Token:
curl -u "API_KEY:API_SECRET" -d "grant_type=client_credentials" "https://api.twitter.com/oauth2/token"
2. Set Environment Variables
bash
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
- Go to developer.x.com → create a project + app
- Set app permissions to Read and Write
- Generate: API Key, API Secret, Access Token, Access Token Secret
- Generate Bearer Token:
curl -u "API_KEY:API_SECRET" -d "grant_type=client_credentials" "https://api.twitter.com/oauth2/token"
2. Set Environment Variables
bash
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ### Auto Mode (for established accounts) Agent posts directly. Use guardrails: - No controversial topics without approval - No tagging accounts with >100k followers without approval - Keep a log of everything posted
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ### Auto Mode (for established accounts) Agent posts directly. Use guardrails: - No controversial topics without approval - No tagging accounts with >100k followers without approval - Keep a log of everything posted
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The delete command immediately deletes a tweet by ID without any confirmation or safeguard. In an automation context, a bad argument, model error, or malicious instruction could irreversibly remove legitimate content and cause operational or reputational damage.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The queue command will automatically publish the first unchecked item in twitter/queue.md with no confirmation, dry-run, or mode enforcement. In a Twitter automation skill, this is materially risky because any upstream agent mistake, prompt injection into the queue file, or accidental draft entry can become a public post immediately.
- Content
Static analysis
No suspicious patterns detected.