X Growth Automation

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:32 PM UTC
• Version: 1.0.1

Overview

This appears to be a legitimate X/Twitter automation scaffold, but it needs review because its helper script can overwrite files in whatever target folder is provided.

Install only if you are comfortable with an agent setting up an automation project for X/Twitter. Use a new empty directory, review the generated config before adding credentials, keep dry-run enabled at first, and enable live posting or reply automation only after setting explicit caps and approval rules.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/scaffold_x_growth_project.py:59

Finding

Unchecked Overwrite of Files in an Arbitrary Target Directory

Content

View full analysis

Vulnerability Details

File Location: scripts/scaffold_x_growth_project.py, lines 59–61 and 78–89
Vulnerability Type: Unrestricted destination path with silent file overwrite
Risk Level: Medium

Vulnerable Code

python

def write(path: Path, content: str):
    path.parent.mkdir(parents=True, exist_ok=True)
    path.write_text(content)

python

root = Path(args.path)
root.mkdir(parents=True, exist_ok=True)

write(root / "README.md", README)
write(
    root / ".env.example",
    ENV_EXAMPLE
        .replace(
            "XGROWTH_DRY_RUN=true",
            f"XGROWTH_DRY_RUN={str(not profile.get('live_publish', False)).lower()}"
        )
        .replace(
            "XGROWTH_PUBLISH_ENABLED=false",
            f"XGROWTH_PUBLISH_ENABLED={str(profile.get('live_publish', False)).lower()}"
        )
)
write(root / "prompts" / "llm-drafting.md", PROMPT)
write(root / "config" / "style-rules.md", STYLE)
write(
    root / "docs" / "operator-notes.md",
    "Fill in operator decisions, niche choices, language rules, community integration, rollout notes, and reply-lane safety rules here.\n\nSuggested live-mode notes:\n- preferred reply sources (mentions only vs broader)\n- what counts as a permanent reply failure\n- whether failed replies should skip or fallback\n- where publish results are logged\n- anti-repetition window (for example last 48h similarity threshold)\n- idempotent slot-key design (stable fields only; never draft text)\n"
)
write(root / "scripts" / "doctor.py", DOCTOR)

Technical Analysis

The script accepts a caller-controlled --path and creates that directory with exist_ok=True. It does not verify that the destination is new, empty, within an approved workspace, or free of symbolic links.

The helper then uses Path.write_text(), which opens existing files for writing and truncates their previous contents. Consequently, running the scaffold against an existing project can silently replace files such as README.md, ` ...[truncated 1827 chars]

Remediation

View remediation

Remediation Suggestions

1. Reject existing or non-empty destinations by default

   • Fail if the target already exists and contains files.
   • Require an explicit --force option for intentional replacement.

2. Validate and constrain the destination

   • Resolve the target with Path.resolve().
   • Reject filesystem roots, home directories, and other sensitive locations.
   • When used by an Agent, require the resolved path to remain under an approved workspace root.

3. Reject symbolic links

   • Check the destination and relevant parent components for symbolic links before writing.
   • Revalidate immediately before file creation to reduce time-of-check/time-of-use risk.

4. Use exclusive creation

   • Create files using exclusive mode, such as open("x"), when overwrite behavior is not explicitly requested.
   • If forced overwrite is supported, list affected files and request confirmation first.

5. Provide backup and preview controls

   • Add a --dry-run option that reports all files that would be created or replaced.
   • Back up existing files before an explicitly authorized overwrite.

6. Validate profile input and fail safely

   • Catch malformed JSON and invalid field types.
   • Validate cadence values and caps before creating any files.
   • Perform all validation before the first filesystem mutation.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs the agent to scaffold a project and fill configuration files, which implies file-write behavior, but the manifest does not declare any tool scope or permissions boundary. That mismatch can cause the skill to be invoked without clear user-visible constraints, increasing the chance of unintended filesystem modifications if the hosting platform grants broader default access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description uses broad trigger language like 'build, clone, publish, or customize an autonomous X growth workflow' and 'connect external editorial feeds into X,' which can match many generic social-media or automation requests. Over-broad invocation increases the likelihood the skill activates in contexts the user did not specifically intend, potentially leading to unnecessary automation setup or write actions with social-posting implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code creates the target root directory and writes multiple files and subdirectories under the user-supplied path. While scaffolding is the script's purpose, the file-writing behavior is not disclosed through a prompt, docstring, or inline comment in this file, so a user reading only the code gets no explicit warning that the path contents will be created or overwritten.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.