Security audit

Social Media Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly for automating an X/Twitter account, but it enables live and scheduled posting without clear approval gates or containment.

Install only if you intend an agent to help operate a real X/Twitter account. Before using it, require draft preview and explicit approval for every post, reply, quote, like, follow, or scheduled job; avoid enabling cron posting until you have clear limits, logs, and a way to stop it quickly.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill description explicitly promotes autonomous social media management, posting, and tracking using browser automation, but it does not warn that these behaviors can perform real actions on a user's X account. Without a prominent warning and confirmation requirement, users may unknowingly authorize actions that publish content, engage with others, or alter account state, creating reputational and operational risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The scheduling section documents cron-based autonomous posting with isolated agent execution, enabling unattended activity on a live social media account. In the absence of strong warnings, approval gates, or safeguards, this creates a significant risk of unauthorized, excessive, mistimed, or policy-violating posts that can damage the account or brand.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill advertises very broad triggers such as requests about tweets, social media strategy, engagement, and audience growth, which can cause it to activate for a wide range of common user intents without clearly signaling that it may take autonomous actions on a real account. In this context, overbroad invocation increases the chance of unintended account-affecting automation being selected when the user expected advice or drafting help only.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The markdown specifies posting times in "UTC+1" as the default timing guide, which imposes a locale-specific recommendation without offering alternatives or indicating that users should adapt it to their own region. This can violate language/locale policy expectations when a skill should avoid forcing a specific locale absent opt-in or clear regional scope.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.