twitter-ai-kol-fetcher

• Analyzed: May 11, 2026, 5:53 AM
• Findings: 1
• Version: 1.0.1
• Hash: 8392e9a35b23f362707be430ab6ce1e23a8dd34ffefd96b95671fddeb0b9a5d8
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains a hardcoded API key for the twitterapi.io service within `scripts/01_fetch_kols.py`, which is a significant security risk. Additionally, the report generation logic in `scripts/03_generate_report.py` is vulnerable to indirect prompt injection because it incorporates unsanitized tweet content directly into LLM prompts. The code also exhibits several functional bugs (e.g., a NameError in the fetcher script) and discrepancies between the stated features in `SKILL.md` (such as Feishu integration) and the actual implementation, suggesting the bundle is poorly vetted or potentially used as a lure.