Security audit

X Social Manager Dist

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it needs Review because it can install tools, use an authenticated X session, post publicly after approval, create agent files, and store detailed personal/social data indefinitely.

Install only if you are comfortable with an agent using your authenticated X account, running command-line tools, and keeping a local plaintext profile of your identity, voice, real replies, audience, leads, and performance history. Review or remove the automatic curl-to-sh install path, pin dependencies, approve every post/reply, restrict when the skill can activate, and periodically inspect/delete the generated memory and strategy files.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:43
Finding: Mutable Remote Installer Is Executed Directly Through a Shell
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:29
Finding: Installation Instructions Execute Unpinned Third-Party Packages
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:379
Finding: Externally Sourced Post Text Is Interpolated into Shell Commands
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:298
Finding: Arbitrary Media URLs Are Retrieved Without Protocol, Destination, or Size Restrictions
Content: View full analysis
If the user shares an image or the topic involves a visual, the agent MUST download and analyze it before drafting. 1. Download: `curl -o "./references/media/analysis_img.jpg" "URL"` 2. Verify file exists: `ls -la ./references/media/analysis_img.jpg` 3. Analyze with vision capability ``` Another affected workflow in `SKILL.md:504-512`: ```markdown > If a post contains images, the agent MUST download and analyze them. **Image Analysis Pipeline:** 1. `twitter tweet [tweet_id] --json` — get post data with media URLs 2. Check the `media` array in the JSON response 3. For each image URL found: - `curl -o "./references/media/analysis_img_N.jpg" "[image_url]"` — download - `ls -la ./references/media/analysis_img_N.jpg` — verify download succeeded - Analyze with vision capability 4. Generate observations for reply crafting or competitive analysis 5. **Video URLs:** Skip with explicit note: "Video detected -- not downloading. Relying on text context." ``` ### Technical Analysis The `curl` commands do not enforce: - HTTPS-only transport. - An approved media-host allowlist. - Rejection of loopback, private, link-local, or internal destinations. - Safe redirect validation. - A maximum response size. - Connection and transfer timeouts. - Expected image MIME types. - Successful image decoding before downstream analysis. Quoting the URL prevents ordinary shell word splitting but does not make the destination safe. Depending on the installed curl configuration, schemes other than HTTPS may also be accepted. A user-supplied URL or malicious media metadata could therefore cause the agent to access local or internal resour ...[truncated 1654 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:600
Finding: Personal and Behavioral Data Is Retained Indefinitely in Plaintext
Content: View full analysis
This is a living document. Append new entries after every significant interaction. Never delete old entries. > **This file is initialized during onboarding and updated continuously by the agent.** ``` From `references/real-replies-archive.md:1-5`: ```markdown # Real Replies Archive > **PURPOSE:** This file contains the user's actual replies word-for-word. The agent MUST read this file before drafting ANY reply to study the user's authentic voice, phrasing, and tone. This is NOT a summary -- t ...[truncated 2807 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (39)

Self-Modification

High

Category: Rogue Agent
Confidence: 94% confidence
Finding: The skill explicitly states that it 'self-updates its own strategy files based on what's working,' which is a self-modification capability. In the context of an instruction-following agent, self-modifying memory and strategy artifacts can drift into unsafe behavior, preserve poisoned data, or broaden future actions without the user noticing.
Content: Scanner excerpt · README.md (reported line 15)May include surrounding context.
md
- **Writes replies** in your authentic voice (not AI-sounding generic praise) - **Runs engagement sessions** with Reply Cards for your approval before posting - **Plans content** with a 60/40 engagement-to-showcase ratio - **Tracks performance** and self-updates its own strategy files based on what's working - **Manages DM outreach** for client acquisition, job hunting, or networking - **Operates the CLI** — can post, reply, search, and analyze directly via `twitter-cli`

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the agent to install and bootstrap host-side tooling (twitter-cli and potentially uv) including piping a remote script directly into sh. That exceeds the normal scope of a social media drafting skill and creates a supply-chain and host-modification risk, especially because it runs based on skill logic rather than an explicit, separate user consent flow.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/branding-strategy.md (reported line 9)May include surrounding context.
md
_[populated during onboarding]_ <!-- The agent should write a thorough analysis covering: 1. **The Context Economy in [User's Niche]**

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/branding-strategy.md (reported line 58)May include surrounding context.
md
_[populated during onboarding -- one sentence that captures the user's brand]_ <!-- Format: "I help [target audience] achieve [outcome] through [unique method/skill]." Example: "I build cinematic landing pages that make startups unforgettable." Example: "I help SaaS founders ship faster with AI-directed full-stack development."

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/branding-strategy.md (reported line 71)May include surrounding context.
md
_[populated during onboarding]_ <!-- | Competitor | Their Angle | Their Weakness | Our Opportunity | |-----------|-------------|----------------|-----------------| | @handle1 | [what they do] | [what they miss] | [how we fill the gap] |

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/content-planner.md (reported line 73)May include surrounding context.
md
_[posts are added here by the Content Planner workflow and removed/marked as posted after execution]_ <!-- ### Planned Post #N - **Status:** draft / approved / posted / skipped - **Type:** [post type from content pillars]

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/growth-strategy.md (reported line 9)May include surrounding context.
md
_[populated during onboarding -- the agent analyzes the user's current X presence and identifies what's broken. Example structure:]_ <!-- You have a **[type] problem**, not a [type] problem. Your [evidence of skill] confirms this -- [specific proof]. Yet your X presence doesn't reflect any of it. **Things that are broken right now:**

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/growth-strategy.md (reported line 92)May include surrounding context.
md
_[populated during onboarding -- customized to the user's primary goal]_ <!-- For CLIENT ACQUISITION: - Warm DM system - Video audit lead magnet

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/growth-strategy.md (reported line 120)May include surrounding context.
md
_[populated during onboarding -- realistic targets based on current follower count, time budget, and niche competitiveness]_ <!-- | Metric | Day 30 | Day 60 | Day 90 | |--------|--------|--------|--------| | Followers | [target] | [target] | [target] |

Hidden Instructions

High

Category: Prompt Injection
Confidence: 86% confidence
Finding: The hidden HTML comment contains operational instructions that are not visible in normal rendered Markdown, directing the agent to analyze the user's real replies and mandatorily read other files before producing output. Hidden instructions are dangerous because they can silently steer model behavior, expand collection of personal data, and create unreviewable control paths that the user may not see or consent to.
Content: Scanner excerpt · references/memory.md (reported line 20)May include surrounding context.
md
## Voice & Reply Architecture  ### Vocabulary Fingerprint

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This workflow includes multiple automatic writes across memory and strategy files with no explicit approval checkpoint. Because those files influence future agent behavior, automatic persistence of externally sourced analysis creates a high-risk prompt/data poisoning pathway and can silently alter project state beyond what a user expects from a social media assistant.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README advertises automatic X account research and browser-session-based authentication but does not prominently warn that the skill may access account data through an active browser session. In this context, the skill can inspect personal or business social activity and act with authenticated context, so missing privacy and data-access disclosures are security-relevant.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README describes a self-evolving system that populates and updates multiple strategy, profile, and memory files, but it does not clearly warn users about persistent file writes and ongoing self-modification. In an agent skill, silent long-lived memory writes can expose sensitive business data, entrench bad instructions, or create difficult-to-audit behavior changes over time.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README presents the skill as a social media manager, but the described behavior includes installing external tooling, using browser-backed account access, operating a CLI, and conducting account research. That broader operational scope materially expands the trust boundary and attack surface beyond content drafting.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The documentation mixes claims that the skill can 'post, reply, search, and analyze directly' with a later assurance that it never posts without explicit approval. This inconsistency can mislead users about the actual autonomy of the skill and increase the chance of unintended account actions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The README instructs users to execute npx skills add ... without pinning a specific version of the installer. That creates a supply-chain risk because the fetched package version can change over time, and users may execute unreviewed code during installation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list includes very broad terms such as "post," "content," "engagement," "growth," "brand," and "DM outreach," which can match many unrelated requests. Over-broad activation increases the chance that this powerful skill is invoked in the wrong context, exposing stored data or causing unintended actions like CLI use or posting workflows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill states it will automatically research the user's X account and populate strategy files, collecting profile, engagement, and behavioral data without an upfront privacy notice or consent checkpoint. Because the system also persists this data, the missing disclosure materially increases privacy risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill promotes an evolving memory system that automatically researches the user's account and stores personal strategy data across files. Persistent retention and propagation of identity, behavioral, and writing-style data increases privacy exposure and the blast radius of any later misuse or compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The setup instructions describe automatic installation using shell commands, including fetching and executing a remote install script, without a prominent safety warning or explicit user approval. This encourages risky execution behavior on the host and normalizes unsafe setup practices.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the agent to archive the user's real replies word-for-word in a reference file. Exact archival of authentic communications creates a reusable corpus of personal expression that can expose sensitive information, enable impersonation, and expand harm if the files are leaked or reused out of context.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill directs the agent to detect its host environment and create IDE/CLI-specific sub-agents, files, or configs. This is an unnecessary expansion of privileges for an X/Twitter manager and can mutate the local workspace or agent runtime in ways the user did not clearly request.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The session initialization requires reading all stored profile, memory, and reply-archive files before any workflow. This broad mandatory reuse of previously collected data increases unnecessary exposure of personal information and makes unrelated tasks depend on maximum-context retrieval.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The memory system directs indefinite accumulation of detailed interaction history, audience intelligence, leads, follower traits, and behavioral analytics. Long-lived, ever-growing storage without retention limits or purpose boundaries materially raises privacy, profiling, and secondary-use risks.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/cli-reference.md (reported line 38)May include surrounding context.
md
- Invent flags not listed in this document - Use `--video` flag (doesn't exist -- video uses `--image` flag with .mp4) - Post without verifying character count - Chain multiple `twitter` commands with `&&` without checking each one succeeded - Use single quotes for text arguments ## Fetching Data

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/subagent-definitions.md:26