Security audit

Twitter Article

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real Notion-to-X Article publishing tool, but it needs careful review because it uses sensitive browser session cookies and can publish or delete X content without built-in safeguards.

Install only if you are comfortable giving this skill access to your X session cookies and a Notion integration key. Use a low-risk X account if possible, limit the Notion token to the needed page, keep cookie values out of logs and shell history, and manually approve any publish, update, upload, or delete command before it runs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The file header and usage text describe only Twitter/X article management, but the implementation also supports Notion ingestion, remote image downloading, and cross-service publishing. This hidden capability increases the chance that operators grant Notion and Twitter credentials without understanding that content and linked media may be fetched from third parties and transmitted across services.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The Notion-to-article workflow adds substantial cross-service behavior beyond the stated Twitter article purpose: it reads Notion content, downloads image URLs, uploads those images to Twitter, and can optionally publish. In a skill context, undeclared multi-service data movement is risky because it can exfiltrate workspace content and trigger unintended network access or publication with only minimal user awareness.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation instructs users to export browser-derived Twitter authentication cookies (`AUTH_TOKEN` and `CT0`) directly into environment variables without any warning about credential sensitivity, storage, shell history exposure, or account takeover risk. Because these cookies can grant authenticated access to the user's Twitter account, mishandling them could enable unauthorized article creation, publication, deletion, or broader account abuse.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The command list includes `publish` and `delete` operations that directly change remote Twitter article state, but the documentation provides no warning that these actions are state-changing and potentially irreversible. This increases the likelihood of accidental publication or deletion by users who may treat the CLI as read-only or low-risk.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The delete command performs a destructive remote action immediately using authenticated Twitter credentials, with no confirmation, dry-run mode, or safeguard against accidental invocation. In CLI or agent environments, a malformed command, prompt injection, or operator mistake could irreversibly remove article drafts or published content.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal