readx

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:39 PM UTC
• Version: 1.1.4

Overview

The skill appears to be a real Twitter/X analysis integration, but it asks agents to handle and persist API keys in risky ways that users should review before installing.

Install only if you are comfortable giving this skill a readx API key and allowing it to store that key in local/editor configuration. Prefer using a platform secret store or environment variable, avoid putting long-lived keys in URLs when possible, and rotate the key if it has been copied into shell history or shared configs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:69
• Finding: API Key Exposed Through URL Query Parameters## Vulnerability Details **File Location**: `SKILL.md:69`; corroborating setup examples at `README.md:27` and `README.md:34` **Vulnerability Type**: Credential exposure through insecure configuration **Risk Level**: Medium ### Vulnerable Code `SKILL.md:69`: ```text MCP server URL: `https://readx.cc/mcp?apikey=<API_KEY>` ``` `README.md:27`: ```bash claude mcp add --transport http readx -s user https://readx.cc/mcp?apikey=<API_KEY> ``` `README.md:30-36`: ```json { "mcpServers": { "readx": { "url": "https://readx.cc/mcp?apikey=<API_KEY>" } } } ``` ### Technical Analysis The Skill instructs users to embed a long-lived API key directly in an MCP URL query parameter. Although transmitting the key to `readx.cc` is required for the declared service, query-string authentication exposes the credential to more components than necessary. The URL may be retained in: - Shell command history - Editor or MCP configuration files - Process arguments and local diagnostic output - Client, proxy, CDN, or server access logs - Error reports and telemetry containing complete request URLs HTTPS protects the URL while it is in transit but does not prevent disclosure through these local or server-side records. The behavior therefore exceeds minimum necessary credential exposure even though it does not constitute deliberate exfiltration to an unrelated domain. ### Attack Path 1. A user substitutes their real API key into the documented MCP URL. 2. The user executes the setup command or saves the URL in an editor configuration. 3. The complete URL is recorded in shell history, configuration, process telemetry, request logs, or diagnostics. 4. An attacker or lower-privileged user obtains access to one of those records. 5. The attacker extracts the query parameter and authenticates to `readx.cc` as the victim. ### Impact Assessment Successful exploitation grants th ...[truncated 434 chars]
• Remediation: ## Remediation Suggestions - Replace query-string authentication with an `Authorization: Bearer` header or another header-based authentication mechanism. - Configure the MCP client to obtain the key from a protected environment variable or secret store rather than interpolating it into a URL. - Ensure credential files use restrictive permissions, such as owner-only access on supported systems. - Avoid placing secrets directly in command-line arguments, examples, diagnostic output, or ordinary editor configuration. - Redact query strings and authorization data from client, proxy, CDN, and server logs. - Provide documented key revocation and rotation procedures for users who may have followed the current setup instructions. - If the MCP protocol requires a URL credential, use a short-lived, narrowly scoped token and exchange it for a session credential rather than exposing a persistent API key.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:98
• Finding: Mutable Remote Documentation Is Treated as Operational Agent Guidance## Vulnerability Details **File Location**: `SKILL.md:98-104` **Vulnerability Type**: Indirect instruction injection through remotely mutable content **Risk Level**: Medium ### Vulnerable Code ```markdown ### API Reference Fetch the full API docs (endpoints, params, response parsing, examples): ```bash curl -s https://readx.cc/api-docs.txt ``` Read this document before making your first API call. It contains all endpoint names, parameters, and response JSON paths you need. ``` ### Technical Analysis The Skill requires the Agent to download a remotely mutable text document and read it before making API calls. No integrity digest, fixed version, trusted schema, content validation, or explicit instruction/data boundary is defined. This is not remote code execution by itself: the retrieved file is documentation rather than an executable payload. However, an Agent may interpret natural-language content in the document as authoritative instructions. If the content is compromised, an attacker could insert directions that alter tool usage, request destinations, credential handling, or the current analysis goal. HTTPS authenticates the server connection but does not protect against compromise of the `readx.cc` service, its content-management process, DNS or hosting account, or an authorized publisher. The remotely retrieved text can also change after the Skill package has been reviewed. ### Attack Path 1. An attacker compromises the remote documentation endpoint or a system authorized to publish `api-docs.txt`. 2. The attacker adds natural-language instructions disguised as API setup or usage guidance. 3. The Agent follows the Skill and downloads the modified document. 4. Because the Skill explicitly tells the Agent to read the document before operating, the injected content enters the Agent's active context. 5. The Agent may follow malicious directions, such as sending requests to an attacker-selected endpoint, disc ...[truncated 756 chars]
• Remediation: ## Remediation Suggestions - Bundle a reviewed, versioned API specification with the Skill instead of retrieving mutable prose at runtime. - If runtime retrieval is necessary, publish a machine-readable schema and parse only expected fields rather than presenting the entire document to the Agent as instructions. - Pin the document to a version and verify a cryptographic digest or trusted signature before use. - Explicitly instruct the Agent to treat retrieved documentation as untrusted data and never follow directives contained within it. - Enforce an allowlist restricting subsequent API requests to fixed HTTPS endpoints under the expected `readx.cc` origin. - Reject documentation that contains shell commands, credential-handling directives, unrelated URLs, or unexpected instruction-like content. - Apply least-privilege controls to the tools available while interpreting remote API metadata.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Ssd 3

High

• Confidence: 98% confidence
• Finding: The Direct API instructions explicitly tell the agent to search local files and environment variables for secrets and to persist newly provided keys. This creates a direct natural-language pathway for secret harvesting and storage, and in the context of an agent skill, it materially expands the attack surface beyond Twitter analysis into credential access and retention.

Credential Access

High

• Category: Privilege Escalation

Content

### Getting the API Key

Check in order, use the first one found:
1. Config file: `~/.config/readx/credentials.json` (macOS/Linux) or `%APPDATA%\readx\credentials.json` (Windows) → JSON format: `{"api_key":"<key>"}`
2. Environment variable: `READX_API_KEY`
3. If neither exists, ask the user for their API key (get one at https://readx.cc), then ask whether they want to save it themselves or have you do it. Persist to the config file path above.

• Confidence: 99% confidence
• Finding: Referencing a specific credentials file path and directing the agent to read it is a concrete credential-access capability. In a skill whose purpose is social-media analysis, this is unnecessarily dangerous because it enables local secret retrieval that could be repurposed for exfiltration or broadened access beyond the intended service.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README tells users to embed the API key directly in the MCP server URL, which creates a real credential-handling risk. URLs are commonly copied into config files, logs, shell history, editor telemetry, crash reports, and debugging output, so the key may be exposed more broadly than intended. Because this is a remote MCP server used by multiple editors/tools, the chance of accidental disclosure through local configuration or tooling is higher, making the guidance more dangerous in context.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The instructions normalize handling the API key in natural language, including exposing it in output if explicitly requested. Once a skill is allowed to retrieve and discuss secrets conversationally, prompt injection, social engineering, or user confusion can lead to credential disclosure that is difficult to contain.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The setup flow asks for the user's API key and instructs embedding it directly into an MCP server URL. Putting credentials into URLs is especially risky because URLs are often logged, cached, copied, displayed in UIs, or stored in configuration files, creating multiple avenues for unintended disclosure.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly authorizes the agent to modify the user's MCP configuration and insert an API key into a server URL, which exceeds a pure Twitter/X analytics function. Even with nominal user consent, granting configuration-writing and credential-persistence behavior increases the chance of unsafe secret handling, accidental credential exposure, and unauthorized local state changes.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger conditions are broad enough that routine mentions of Twitter analysis or transient tool failures could launch setup flows that ask for credentials or reconfigure tooling. This increases the likelihood of unnecessary secret collection and unplanned side effects in situations where the user did not clearly request setup assistance.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The Direct API Mode tells the agent to inspect local credential files, read environment variables, and write API keys back to disk. That is secret-management functionality unrelated to the core analytics purpose and creates a broad capability to access, collect, and persist sensitive data that could be abused or mishandled.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill instructs the agent to save API credentials to disk but does not present a strong, prominent warning about the sensitivity of the data or safer alternatives. This encourages casual persistence of secrets in user-accessible locations, increasing the risk of leakage through filesystem exposure, backups, logs, or later agent access.

Static analysis

No suspicious patterns detected.