X Tweet Fetcher

• Outcome: Review
• Latest audit: May 29, 2026 · 9:25 PM UTC
• Version: 1.4.0

Overview

This is a functional social-media fetching skill, but some paths use session cookies, SSH, and router command queues with weak user-facing controls, so it needs review before installation.

Install only if you want a broad scraping and monitoring tool, not just a simple tweet fetcher. Prefer the basic fetch paths, run Camofox in an isolated environment, avoid passing primary-account cookies, and do not use --via-ssh, --via-router, or Xiaohongshu router fallback unless you fully control the remote host or router-agent files and understand that another component may execute queued commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tainted flow: 'queue_file' from os.environ.get (line 39, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

search_url = f'https://weixin.sogou.com/weixin?type=2&query={encoded_kw}'
    cmd = f'curl -s {shlex.quote(search_url)} -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36"'
    
    with open(queue_file, 'w') as f:
        f.write(cmd)
    
    print(f"Command queued, waiting for router (up to 90s)...", file=sys.stderr)

• Confidence: 88% confidence
• Finding: The script writes a shell command into a filesystem path taken from environment variables, creating a command-queue interface that can influence another privileged component. Even with absolute-path and '..' checks, an attacker who can control the environment or target files could redirect writes into sensitive control files or abuse this mechanism to trigger unintended network actions.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill documents substantial capabilities including network access, shell execution, local file access, and environment use, but does not declare permissions or clearly constrain those operations. In an agent environment, this weakens user understanding and policy enforcement, increasing the chance that the skill is invoked with broader privileges than expected.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented behavior understates the apparent operational scope: beyond tweet fetching, the skill appears to support broader discovery, monitoring, proxy/cookie-assisted access, command-queue interaction, and other platform scraping modes. This creates a significant trust gap, because operators may approve a seemingly simple fetcher while actually enabling a much more invasive collection and execution surface.

Context-Inappropriate Capability

High

• Confidence: 90% confidence
• Finding: Advertising 'User profile analysis' with MBTI, Big Five, and topic graph inference goes beyond content retrieval into behavioral profiling of individuals. In an agent skill context, this creates meaningful privacy and misuse risk because it can enable sensitive inference, targeting, or surveillance without clear consent, safeguards, or justification tied to the fetcher's stated purpose.

Description-Behavior Mismatch

Medium

• Confidence: 81% confidence
• Finding: The file structure and requirements expose an AI-powered profile analysis component that is outside the stated scope of simple content fetching. Hidden or underdocumented analysis features can cause unexpected data processing, third-party API transmission, and trust violations for users who only intended retrieval functionality.

Context-Inappropriate Capability

Medium

• Confidence: 78% confidence
• Finding: An AI-powered profile analyzer is not necessary for the core stated purpose of unauthenticated tweet fetching, so its inclusion expands data handling and external dependency risk without clear justification. In practice this can lead to unnecessary transmission of user or scraped profile data to third-party model providers.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The Xiaohongshu parser writes a shell command to fixed files under /root/router-agent and depends on another privileged local component to execute it. Even though the URL is shell-quoted, this creates an unexpected cross-component command-dispatch channel that extends the skill's capabilities beyond content fetching and may exfiltrate requests through a trusted home router context, potentially bypassing network controls and operating with elevated trust.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The helper is presented as fetching via a router home IP, but the implementation actually writes a curl command for another local agent to execute. That hidden behavior is dangerous because it obscures the real trust boundary and execution path, making it easier to smuggle network actions through a separate privileged service without transparent user awareness or review.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Embedding SSH file transfer and remote Python execution in a WeChat search helper materially exceeds the stated purpose and creates a covert remote-execution capability. In an agent skill context, this is more dangerous because the agent may be granted network and local file access, turning a content-fetching tool into infrastructure pivoting functionality.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The router command-queue mechanism writes shell commands to local control files for later execution by another system, which is effectively an indirect command-execution channel unrelated to normal search behavior. In an agent setting this is especially risky because it can be abused as a persistence or lateral-movement primitive, masking active command dispatch as benign scraping support.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation promotes Google search through Camofox as 'zero-cost' but does not clearly disclose that search queries are sent to both a local browser service and Google. This is a privacy and data-governance issue because sensitive prompts, investigations, or internal terms could be transmitted externally without the user's informed awareness.

Missing User Warnings

Low

• Confidence: 76% confidence
• Finding: The X-Tracker section describes scheduled sampling and reporting but does not disclose that the feature likely stores tracking data locally and performs recurring outbound requests over time. This can create unanticipated persistence, data retention, and background network activity in environments where users expect one-off fetch behavior.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code accepts and forwards user-supplied session cookies in HTTP requests to remote services without clear warning about the sensitivity of those credentials. In this skill context, cookies may grant account access, so users could unknowingly expose authenticated sessions to third-party platforms or combine them with proxies in ways that increase interception and misuse risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script writes commands to and reads results from fixed paths under /root/router-agent, implicitly coupling itself to a privileged local service and filesystem location without user-facing disclosure. In the context of a scraping skill, this hidden side effect is riskier because it can trigger unexpected privileged behavior, interfere with other automation, and leak fetched content or command data across trust boundaries.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Monitor mode sends the target username/handle to Google via Camofox search queries without clear user consent at the point of use. This can leak monitored identities and analyst interest to external parties, which is especially sensitive in OSINT, journalism, or monitoring of private individuals.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.