Twitter

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:39 PM UTC
• Version: 1.0.1

Overview

This tweet-writing skill is mostly a drafting guide, but it needs review because it requires external web research and points to required instructions outside the audited package.

Before installing, be comfortable with the agent using web search for your tweet topics, and avoid entering confidential client names, embargoed campaigns, or private business plans. Treat the external instruction link as untrusted unless the publisher moves all required instructions into the audited skill package.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:13
• Finding: Mutable External Instructions Can Hijack Skill Behavior## Vulnerability Details **File Location**: `SKILL.md`, line 13 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium **Vulnerable Code:** ```markdown [READ THE INSTRUCTIONS BEFORE USE](https://claude.ai/public/artifacts/59bf1058-3a4c-450b-af5b-c85c13cfa8ab) ``` ### Technical Analysis The skill directs the agent or user to read operational instructions hosted outside the audited package. The external artifact is not included in the repository and may be modified independently after the skill has been reviewed. If the remote content is loaded into the agent's context and treated as authoritative instructions, it may alter the skill's behavior, introduce new tool-use requirements, request sensitive information, or attempt to override higher-priority goals and safety constraints. The local package provides no integrity pinning, trusted-content policy, or instruction-precedence warning for this external material. This finding does not establish that the current remote artifact is malicious. The vulnerability arises because mutable, unaudited remote content is presented as required instructions and may therefore change the effective behavior of the skill after installation. ### Attack Path 1. An attacker compromises, replaces, or otherwise gains control over the linked external artifact. 2. The attacker inserts instructions that conflict with the locally audited workflow, such as directions to disclose contextual information or invoke unrelated tools. 3. A user or agent loads the skill and follows the prominent directive to read the external instructions. 4. The remote content enters the agent's active context and is interpreted as trusted operational guidance. 5. The attacker-controlled instructions influence the current session's outputs or actions. ### Impact Assessment Exploitation could alter the goals and behavior of the current agent session. Depending on the tools and contextual data a ...[truncated 448 chars]
• Remediation: ## Remediation Suggestions 1. Move every instruction required for the skill's operation into the audited `SKILL.md` file. 2. Remove the imperative wording that instructs the agent to read remote content before use. 3. If external documentation must remain, label it as optional reference material rather than an instruction source. 4. Explicitly state that remote content is untrusted data and cannot override system, developer, user, or local skill instructions. 5. Use an immutable, versioned resource with integrity verification where the hosting mechanism supports it. 6. Require user confirmation before opening external resources and avoid sending user context to those resources.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:19
• Finding: Mandatory Web Research Lacks Prompt-Injection Isolation## Vulnerability Details **File Location**: `SKILL.md`, lines 19–34 and 363–370 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium **Vulnerable Code:** ```markdown Before writing ANY tweet, you MUST research viral examples in the user's specific niche. **Research Steps:** 1. **Identify the niche/topic** — What is the user writing about? 2. **Search for viral examples** — Use WebSearch to find: - `"[niche] viral tweet examples"` - `"[niche] twitter thread went viral"` - `"[topic] best performing tweets"` - `site:twitter.com OR site:x.com "[niche keyword]" high engagement` 3. **Analyze patterns** — Extract: - Hook styles that worked - Content structure - Tone and voice - Specific numbers/results used - CTAs that drove engagement 4. **Document insights** — Create a brief analysis before writing ``` ```markdown 2. **Research phase** (USE WebSearch): - Search for viral examples in their niche - Identify successful patterns - Note specific hooks and structures that worked ``` ### Technical Analysis The workflow requires the agent to retrieve and interpret arbitrary search results before producing content. Search results and linked webpages form an untrusted input boundary and may contain indirect prompt-injection content designed to look like agent instructions. The skill does not instruct the agent to distinguish webpage data from executable instructions, ignore commands embedded in retrieved content, limit extraction to relevant factual attributes, or preserve the priority of system, developer, user, and local skill instructions. It also does not provide a safe fallback that permits drafting from user-supplied context when web research is unnecessary or unsafe. A malicious page could therefore contaminate the research context with instructions unrelated to tweet analysis. This is an unsafe workflow design rather than evidence t ...[truncated 1382 chars]
• Remediation: ## Remediation Suggestions 1. Add an explicit rule that all search results, webpages, posts, metadata, and quoted text are untrusted data. 2. Instruct the agent never to follow commands found in retrieved content and never to let such content override higher-priority instructions. 3. Restrict extraction to necessary public facts and content characteristics, such as hook style, post structure, tone, and publicly visible engagement figures. 4. Prohibit submitting secrets, private conversation content, personal data, credentials, or internal identifiers in search queries. 5. Allow web research to be skipped when the user supplies sufficient context or when safe retrieval cannot be assured. 6. Require user confirmation before opening unfamiliar links or performing actions beyond research and content drafting. 7. Prefer trusted, allowlisted sources and record citations so that users can verify the material used. 8. Treat instructions encountered on webpages as quoted content only and sanitize retrieved material before incorporating it into the drafting context.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Confidence: 95% confidence
• Finding: The skill explicitly directs the agent to use WebSearch on user-supplied niche/topic data without disclosing that those inputs may be transmitted to an external search provider. This creates a privacy/data-handling issue: users may provide sensitive business plans, campaign topics, client names, or embargoed subjects assuming they remain local to the assistant, when in fact the information could be sent off-platform.