Security audit

Production-ready Twitter/X data and automation for autonomous agents

Security checks for vulnerabilities and agentic risk

Overview

The skill discloses many risks, but it bundles social-monitoring features with account-changing Twitter automation that sends raw account and proxy credentials to a third-party API.

Install only if you are comfortable sending your AIsa API key and queries to api.aisa.one. Avoid the write operations unless you use a disposable automation account, unique password, non-sensitive proxy credentials, and understand that the third-party service may gain account-level control. Do not pass real passwords or TOTP codes on the command line, and do not run cleanup.sh from a directory containing unrelated work or secrets.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: twitter_client.py:251
Finding: Twitter Credentials, TOTP Codes, Proxy Credentials, and API Key Transmitted to a Third Party
Content: View full analysis
Dict[str, Any]: print( "⚠️ WARNING: Transmitting credentials to third-party API", file=sys.stderr ) print( "⚠️ Ensure you are using a dedicated test account only!", file=sys.stderr ) data = { "user_name": username, "email": email, "password": password, "proxy": proxy } if totp_code: data["totp_code"] = totp_code return self._request("POST", "/twitter/user_login_v3", data=data) ``` The Skill documentation also explicitly instructs users to submit the credentials: ```bash curl -X POST "https://api.aisa.one/apis/v1/twitter/user_login_v3" \ -H "Authorization: Bearer $AISA_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "user_name": "test_automation_account", "email": "test@example.com", "password": "unique_password_here", "proxy": "http://user:pass@proxy-ip:port" }' ``` ### Technical Analysis The login operation sends a Twitter username, email ...[truncated 2566 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: twitter_client.py:438
Finding: Sensitive Credentials Accepted Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:20
Finding: Read Operations Incorrectly Claim That No Credentials Are Transmitted
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: cleanup.sh:16
Finding: Cleanup Script Can Delete Unrelated Files and Print Detected Secrets
Content: View full analysis
/dev/null | wc -l) if [ "$found" -gt 0 ]; then echo "🗑️ Removing $description... ($found files)" find . -name "$pattern" -type f -delete 2>/dev/null count=$((count + found)) fi } remove_dirs() { local pattern=$1 local description=$2 local found=$(find . -type d -name "$pattern" 2>/dev/null | wc -l) if [ "$found" -gt 0 ]; then echo "🗑️ Removing $description... ($found directories)" find . -type d -name "$pattern" -exec rm -rf {} + \ 2>/dev/null || true count=$((count + found)) fi } ``` The script recursively removes broadly named files and directories: ```bash remove_dirs ".vscode" "VS Code settings" remove_dirs ".idea" "IntelliJ IDEA settings" remove_files "*.log" "Log files" remove_files "*.bak" "Backup files" remove_dirs "build" "Build directories" remove_dirs "dist" "Distribution directories" ``` The secret checks print complete matching lines: ```bash if grep -r "sk-[a-zA-Z0-9]\{20,\}" . 2>/dev/null \ | grep -v ".git" \ | grep -v "cleanup.sh" \ | grep -v "PACKAGE_HYGIENE.md"; then echo "⚠️ WARNING: Potential API keys found!" secrets_found=true fi if grep -r "password.*=.*['\"][^'\"]*['\"]" . 2>/dev/null \ | grep -v ".git" \ | grep -v "cleanup.sh" \ | grep -v "SECURITY.md" \ | grep -v "twitter_client.py"; then echo "⚠️ WARNING: Potential hardcoded passwords found!" secrets_found=true fi ``` ### Technical Analysis All `find` and `grep` operations are rooted at `.`—the caller's current working directory—not the directory containing `cleanup.sh`. The script does ...[truncated 2101 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence

Findings (60)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · BEFORE_AFTER_COMPARISON.md (reported line 195)May include surrounding context.
md
[Immediately sends credentials with no warning]

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · NON_TEXT_FILES_REMOVAL.md (reported line 129)May include surrounding context.
-x "pycache/"
-x ".pyc"
-x ".git/*"
-x ".env"

text
#### Method 3: Manual Tar with Exclusions

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · NON_TEXT_FILES_REMOVAL.md (reported line 140)May include surrounding context.
-x "pycache/"
-x ".pyc"
-x ".git/*"
-x ".env"

text
#### Method 3: Manual Tar with Exclusions

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · PACKAGE_HYGIENE.md (reported line 241)May include surrounding context.
-x "pycache/"
-x ".pyc"
-x ".git/*"
-x ".env"

text
#### Method 3: Manual Tar with Exclusions

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · PACKAGE_HYGIENE.md (reported line 290)May include surrounding context.
-x "pycache/"
-x ".pyc"
-x ".git/*"
-x ".env"

text
#### Method 3: Manual Tar with Exclusions

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SECURITY.md (reported line 211)May include surrounding context.
-x "pycache/"
-x ".pyc"
-x ".git/*"
-x ".env"

text
#### Method 3: Manual Tar with Exclusions

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · cleanup.sh (reported line 131)May include surrounding context.
sh
-x "__pycache__/*" \ -x "*.pyc" \ -x ".git/*" \ -x ".env" ``` #### Method 3: Manual Tar with Exclusions

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · PACKAGE_HYGIENE.md (reported line 39)May include surrounding context.
4. Sensitive Files (CRITICAL)

text
.env # Environment variables *.key # API keys *.pem # Private keys credentials.json # Credentials

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · PACKAGE_HYGIENE.md (reported line 151)May include surrounding context.
4. Sensitive Files (CRITICAL)

text
.env # Environment variables *.key # API keys *.pem # Private keys credentials.json # Credentials

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · PACKAGE_HYGIENE.md (reported line 277)May include surrounding context.
4. Sensitive Files (CRITICAL)

text
.env # Environment variables *.key # API keys *.pem # Private keys credentials.json # Credentials

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · PACKAGE_HYGIENE.md (reported line 313)May include surrounding context.
4. Sensitive Files (CRITICAL)

text
.env # Environment variables *.key # API keys *.pem # Private keys credentials.json # Credentials

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · cleanup.sh (reported line 130)May include surrounding context.
sh
### 4. Sensitive Files (CRITICAL) ``` .env # Environment variables *.key # API keys *.pem # Private keys credentials.json # Credentials

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · PACKAGE_HYGIENE.md (reported line 42)May include surrounding context.
.env # Environment variables *.key # API keys .pem # Private keys credentials.json # Credentials secrets.json # Secrets config.local. # Local configuration

text

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · PACKAGE_HYGIENE.md (reported line 154)May include surrounding context.
.env # Environment variables *.key # API keys .pem # Private keys credentials.json # Credentials secrets.json # Secrets config.local. # Local configuration

text

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · PACKAGE_HYGIENE.md (reported line 43)May include surrounding context.
*.key # API keys .pem # Private keys credentials.json # Credentials secrets.json # Secrets config.local. # Local configuration

text

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · PACKAGE_HYGIENE.md (reported line 155)May include surrounding context.
*.key # API keys .pem # Private keys credentials.json # Credentials secrets.json # Secrets config.local. # Local configuration

text

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · QUICK_REFERENCE.md (reported line 112)May include surrounding context.
md
→ No warnings, works great ✅

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: A social listening and intelligence-gathering skill does not need credential-based account actions, yet the README documents operations that require sending sensitive Twitter credentials to a third-party API. This creates a serious risk of credential theft, account takeover, and misuse of agent permissions, especially because the dangerous capability is bundled into a skill whose stated purpose is monitoring rather than account control.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · SECURITY_IMPROVEMENTS.md (reported line 355)May include surrounding context.
md
## Next Steps 1. Replace original files with improved versions 2. Update package version to reflect security improvements 3. Add SECURITY.md to package distribution 4. Update ClawHub listing with security notice

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The manifest and description frame the skill as safe/read-only by default, but the file clearly documents login and write actions including posting, liking, retweeting, and profile updates. That mismatch is dangerous because users and agents may approve or invoke the skill under a lower-risk assumption while it can transmit credentials and perform account-changing actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The manifest and description frame the skill as safe/read-only by default, but the file clearly documents login and write actions including posting, liking, retweeting, and profile updates. That mismatch is dangerous because users and agents may approve or invoke the skill under a lower-risk assumption while it can transmit credentials and perform account-changing actions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is marketed as read-only social listening/monitoring, but the file also implements authenticated write actions such as login, post, like, and retweet. In an agent setting, this creates a capability mismatch that can mislead users or higher-level orchestration into invoking account-changing actions, expanding risk well beyond the declared purpose.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The login method collects Twitter username, email, password, proxy, and optional TOTP code, then transmits them to a third-party service. Even though the code prints warnings, it still enables credential exfiltration to an external operator, which is especially dangerous because the stated skill purpose is search/monitoring and does not require account credentials at all.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation presents the skill as primarily safe and read-only, but this file explicitly retains high-risk write capabilities such as login and posting. That mismatch can mislead users, reviewers, or downstream agents into invoking credential-handling features under a safer-looking 'Search + Monitor' label, increasing the chance of unsafe use.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file admits that the underlying functionality is unchanged and still transmits Twitter credentials to a third-party API for write operations, despite the new security-focused framing. Improved warnings do not reduce the core security exposure: sensitive credentials are still exfiltrated to an external service, which creates account-compromise and credential-reuse risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Anti-Refusal Statement

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

4. Sensitive Files (CRITICAL)

Credential Access

4. Sensitive Files (CRITICAL)

Credential Access

4. Sensitive Files (CRITICAL)

Credential Access

4. Sensitive Files (CRITICAL)

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Anti-Refusal Statement

Context-Inappropriate Capability

Self-Modification

Tp4

Tp4

Description-Behavior Mismatch

Context-Inappropriate Capability

Description-Behavior Mismatch

Intent-Code Divergence

Static analysis