Twitter Article Reader

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:20 PM UTC
• Version:
  1.0.0

Overview

This is a simple instruction-only Twitter/X reader that openly routes user-provided links through jina.ai, with the main privacy consideration being that the link is sent to that external service.

Install only if you are comfortable having the Twitter/X link fetched through jina.ai. Avoid using it for private, restricted, or sensitive URLs; the artifacts show no hidden code, credential use, persistence, or local data access.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to send user-provided Twitter/X URLs to the external service r.jina.ai, but it does not warn users that their requested link and associated fetch request will be disclosed to a third party. This creates a privacy and trust risk, especially when users submit sensitive, private, or identifying links under the assumption the agent is fetching them directly.

VirusTotal

66/66 vendors flagged this skill as clean.