X Read

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:57 PM UTC
• Version: 1.0.1

Overview

The skill is a read-only X/Twitter summarizer, but its implementation can browse arbitrary URLs in an unsandboxed Chromium process and has dependency and logging risks users should review.

Review before installing. Use only in an isolated environment, restrict it to trusted X permalinks, and prefer a version that validates allowed hosts, blocks local/private-network destinations and redirects, restores browser sandboxing or runs in a hardened container, removes raw debug page logging, and updates or pins dependencies.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:3

Finding

Unrestricted URL Navigation in an Unsandboxed Chromium Process

Content

View full analysis

{ const browser = await puppeteer.launch({ headless: "new", args: ['--no-sandbox', '--disable-setuid-sandbox', '--disable-dev-shm-usage'], defaultViewport: { width: 1280, height: 800 } }); try { const page = await browser.newPage(); // Set a standard user agent to avoid immediate blocks await page.setUserAgent('Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36'); // Navigate to the tweet URL console.log("Navigating to:", url); await page.goto(url, { waitUntil: 'domcontentloaded', timeout: 30000 }); ``` ### Technical Analysis The URL is read directly from `process.argv[2]` and passed to `page.goto()` without validation of its scheme, hostname, port, destination address, or redirect chain. Although `SKILL.md` states that callers should provide an `https://x.com/...` permalink, this requirement is not enforced by the implementation. A caller can therefore direct the browser to an arbitrary HTTP or HTTPS destination, including an attacker-controlled website, loopback service, or private-network endpoint reachable from the skill's execution environment. This creates an SSRF-like browser request primitive. Loading an attacker-controlled page also permits that page's JavaScript and subresources to execute inside Chromium. The associated browser is launched with both `--no-sandbox` and `--disable-setuid-sandbox`, disabling important Chromium process-isolation controls. If malicious page content exploits a browser vulnerability, the absence of the sandbox may substantially increase the potential impact. The ...[truncated 1965 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Known Vulnerable Dependency: basic-ftp==5.1.0 — 4 advisory(ies): CVE-2026-27699 (Basic FTP has Path Traversal Vulnerability in its downloadToDir() method); GHSA-6v7q-wjvx-w8wg (basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Exe); CVE-2026-41324 (basic-ftp vulnerable to denial of service via unbounded memory consumption in Cl) +1 more

Critical

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

- Review the `index.js` script if X changes its DOM selectors (it relies on `data-testid` attributes such as `tweet`, `tweetText`, `User-Name`, and `card.wrappe

Known Vulnerable Dependency: extract-zip==2.0.1 — 2 advisory(ies): CVE-2026-19693 (extract-zip allows arbitrary file writes through symlink archive entries); CVE-2026-56876 (extract-zip unvalidated symlink path traversal)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

extract-zip is a real vulnerable dependency in the installed tree, and Puppeteer's browser download/install path can use it when fetching and unpacking browser archives. If an attacker can influence the downloaded archive or the install/update source, the symlink traversal issues could lead to arbitrary file writes during extraction.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

js-yaml is a genuine vulnerable dependency in the dependency graph, and its known issues are denial-of-service problems during parsing of malicious YAML structures. Since Puppeteer includes cosmiconfig, hostile local configuration files or untrusted YAML input reaching that parser could consume excessive CPU and disrupt execution.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

ws is a real vulnerable transitive dependency used by puppeteer-core for WebSocket communication with the browser. Memory disclosure or memory-exhaustion flaws in that channel could be exploitable if an attacker can interfere with or spoof the DevTools/WebSocket endpoint, making this more relevant than purely unused helper libraries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill logs extracted tweet text directly to stdout via the debug output, which can disclose full post contents, handles, and other scraped data to callers, logs, or downstream systems without minimization. In an agent-skill context, stdout is often captured and persisted, so this creates an unnecessary data exposure path beyond the intended summary behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

When parsing fails, the fallback prints document.body.innerText, which may expose far more page content than necessary, including unrelated page text, prompts, and metadata. Because this is a rendering/summarization skill, dumping the full page body is excessive and increases the chance of sensitive or unexpected content leakage into logs.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The dependency version for Puppeteer is specified with a caret range, which allows newer minor and patch releases to be installed automatically. This can introduce supply-chain risk or unexpected behavior changes if an upstream release is compromised or incompatible, especially in a skill that fetches and renders untrusted remote web content.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json

"author": "Tyler",
  "license": "ISC",
  "dependencies": {
    "puppeteer": "^24.37.5"
  }
}

Static analysis

No suspicious patterns detected.