Security audit

Niche Twitter

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Twitter/X research purpose, but it asks for recurring cron-style monitoring and notifications without clear consent, limits, or a stop mechanism.

Review this skill before installing if you do not want an agent to set up recurring Twitter/X monitoring. Use it only for explicit Twitter/X research or content tasks, and require confirmation before any cron job, scheduled search, or notification workflow is created.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The manifest's 'Use when' guidance is broad and overlaps with general research and content-generation functions, making accidental activation more likely. Poorly bounded activation can expose users to unnecessary external searches, browsing, or specialized behaviors not appropriate for routine requests.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: Advertising 'autonomous monitoring via cron/web_search' without warning users about persistence, recurrence, and data/privacy implications can lead to monitoring behavior users did not knowingly authorize. This is especially risky because monitoring implies repeated external actions and possible retention or notification flows beyond a one-off request.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger conditions are broad enough to match many ordinary social-media, influencer, or content requests, which can cause the skill to activate outside its intended niche scope. Over-broad invocation increases the chance of unintended tool use, unnecessary browsing/searching, and routing users into behaviors like monitoring or script-backed workflows they did not explicitly request.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The skill instructs execution of a local script (`exec scripts/format-thread.py`) even though the skill is primarily for Twitter/X research and content generation. Introducing local code execution expands the trust boundary and can enable unintended command/script execution, supply-chain risk, or abuse if the script or its inputs are modified.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The monitoring section proposes proactive recurring searches and notifications but does not include guardrails, consent, retention limits, or transparency about privacy impact. Without those controls, users may be subjected to ongoing surveillance-like behavior or unintended external activity triggered by ambiguous requests.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The generated Twitter search query forcibly includes `lang:en`, which restricts results to English regardless of user preference. This is a natural-language locale policy concern because the script imposes a specific language without offering opt-in, configuration, or a documented reason for the restriction.

Natural-Language Policy Violations

Low

Confidence: 86% confidence
Finding: The reference explicitly presents `lang:en` as the language operator and repeats it in example queries, which biases the skill toward English-only results. Because the file does not offer alternative language choices or explain that English is optional, this can conflict with a language/locale choice policy.

Natural-Language Policy Violations

Low

Confidence: 91% confidence
Finding: The example searches for WHL scouting, AI agents, and acreage all include `lang:en`, which imposes an English-only locale choice across varied topics. The file does not justify this restriction as region-specific or provide a user-selectable alternative, so it appears to enforce a language preference in natural-language guidance.

Static analysis

No suspicious patterns detected.