Security audit

Felo Twitter Writer

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent Twitter/X writing purpose, but it can automatically attach the workflow to an unrelated private LiveDoc and forces verbatim use of external service output.

Review this before installing if you use Felo LiveDocs for private or unrelated projects. Prefer creating a fresh Twitter Writer LiveDoc or explicitly choosing the document, and treat generated output as coming from an external Felo service rather than as locally reviewed content.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:12
Finding: Untrusted Remote SuperAgent Output Is Returned Verbatim Without Local Review
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:18
Finding: Automatic Selection of the Most Recent Private LiveDoc Violates Project Isolation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README explicitly instructs users to fetch tweets from arbitrary X accounts and send tweet content and bio data to SuperAgent, but it does not warn that this data is transmitted to a third-party service or discuss privacy, data handling, or consent considerations. In this skill context, the missing disclosure is more concerning because the feature is specifically designed to copy or analyze identifiable writing styles from public accounts, which can normalize repurposing third-party content without transparency.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Multiple primary command examples hard-code --accept-language en, and the automated Claude flow is described around English-first behavior without stating that the user can choose their preferred language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to fetch tweet/account data via external tools, send enriched tweet content to SuperAgent, and persist identifiers/state in LiveDoc, but the public-facing description does not disclose that user-provided account content and generated context will be transmitted and stored externally. This creates a transparency and privacy-consent gap that can expose third-party content, user prompts, and session state without informed user awareness, especially when handling non-public project context in LiveDocs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This instruction hard-codes locale behavior by requiring automatic language detection and defaulting to en when uncertain. The policy allows language constraints when the user is given a choice or the restriction is clearly justified, but this line imposes the behavior without opt-in.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This manifest describes the skill's capabilities in broad terms but does not define specific trigger phrases, invocation boundaries, or exclusion conditions. In a manifest file, that ambiguity can cause the skill to match loosely to general writing requests rather than a clearly scoped Twitter/X-style task.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.