twitter-research

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:37 AM UTC
• Version: 1.0.1

Overview

This skill is transparent about paid Twitter/X reads, but it should be reviewed carefully because it relies on mutable external CLI and remote skill installs tied to wallet-funded payments.

Install only if you are comfortable running the SELAT npm CLI and funding a wallet for paid reads. Confirm prices with the dry run, approve each paid action explicitly, avoid elevated npm installs, and treat the remote SELAT skill and CLI as external code that may change over time.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Executable Dependency and Remotely Resolved Skill

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:12-17, SKILL.md:65-66, and SKILL.md:75-77
Vulnerability Type: Unpinned third-party executable dependency and mutable remote Skill retrieval
Risk Level: Medium

Vulnerable Code

yaml

requires:
  anyBins:
    - selat
    - npm
install:
  - kind: node
    package: "@selat-ai/selat-cli"
    bins:
      - selat

bash

selat --version || npm install -g @selat-ai/selat-cli

bash

selat skill install twitter-research
SELAT_ROUTER_URL=https://router.selat.ai \
  selat skill verify ~/.config/selat/skills/twitter-research

Technical Analysis

The npm dependency @selat-ai/selat-cli is installed without an exact version, lockfile, or integrity digest. The command therefore resolves whatever package version the registry serves at execution time. Because npm packages and their transitive dependencies contain executable code, the effective behavior can change after this Skill has been reviewed.

The global installation expands the exposure: package lifecycle scripts and subsequent CLI execution run with the permissions of the invoking user. The separately executed selat skill install twitter-research command also retrieves a remote Skill whose resolved manifest is not included in the audited project. Consequently, the local artifact cannot independently verify the document's claims that the installed Skill is declarative, read-only, HTTPS-only, vetted, or constrained by appropriate spending limits.

This finding identifies a supply-chain weakness rather than evidence that the current SELAT package or service is malicious.

Attack Path

1. An attacker compromises the npm publisher account, registry distribution path, a transitive dependency, or the remote Skill distribution channel.
2. The attacker publishes a modified package version or replaces the remotely resolved twitter-research Skill.
3. A user follows the d ...[truncated 1702 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @selat-ai/selat-cli to an exact, reviewed version rather than allowing npm to resolve the latest release.
2. Publish and verify an integrity hash or signed provenance record for the expected package artifact and its dependency graph.
3. Use a committed lockfile and a deterministic installation mechanism such as npm ci.
4. Avoid global installation. Run the CLI in an isolated, least-privileged environment, such as a dedicated project directory, container, or restricted user account.
5. Review npm lifecycle scripts and consider disabling them during installation when they are not required.
6. Include the resolved twitter-research manifest in this project so its endpoints, parameters, spending controls, and read-only guarantees can be audited.
7. Pin the remote Skill to an immutable version and checksum, and reject any downloaded content whose digest does not match.
8. Enforce a local allowlist for network destinations and validate that all endpoints use HTTPS with expected hostnames.
9. Require explicit user confirmation for each paid operation, displaying the exact endpoint, amount, and transaction destination independently of remote Skill output.
10. Apply wallet-side per-call and cumulative spending limits that cannot be weakened by the downloaded Skill or CLI.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description frames the skill as read-only Twitter/X research and says it runs only the needed reads. However, the documented behavior also directs the agent to perform financial and account-management operations via selat init and selat fund, which go beyond Twitter data retrieval itself. While these may support paid access, they are still additional operations not reflected in the high-level skill description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The stated purpose of this skill is Twitter/X research, but the 'Beyond this skill' section tells the agent to run selat search and selat skill list --available for other intents. Capability discovery across the broader SELAT ecosystem is not necessary to fulfill the declared Twitter-research purpose and extends the skill's operational scope.

Content

No source excerpt is available for this finding.