Security audit

Xquik X API

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Xquik API/MCP integration guide whose sensitive actions are described as approval-gated, though users should treat its copy-ready metered and webhook examples carefully.

Install only if you intend to use Xquik and are comfortable giving it an API key with the chosen account scope. Use OAuth or a secret store where possible, prefer scoped keys, never paste X passwords/cookies/session tokens, and require a fresh explicit confirmation before any post, DM, follow, profile change, delete, private read, extraction, draw, monitor, webhook, or other metered/persistent action. Harden webhook sample code with body-size limits, timeouts, and rate limiting before exposing it publicly.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: references/workflows.md:86
Finding: Metered and Persistent Workflow Examples Do Not Enforce the Required Approval Boundary
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/webhooks.md:69
Finding: Webhook Examples Buffer Unbounded Unauthenticated Request Bodies
Content: View full analysis
chunks.push(chunk)); req.on("end", () => { const payload = Buffer.concat(chunks).toString("utf8"); const signature = req.headers["x-xquik-signature"]; if (!verifySignature(payload, signature, WEBHOOK_SECRET)) { res.writeHead(401).end("Invalid signature"); return; } ``` Python example in `references/webhooks.md:126-130`: ```python def do_POST(self): signature = self.headers.get("X-Xquik-Signature", "") length = int(self.headers.get("Content-Length", "0")) payload = self.rfile.read(length) if not verify_signature(payload, signature, WEBHOOK_SECRET): ``` Go example in `references/webhooks.md:175-183`: ```go func webhookHandler(w http.ResponseWriter, r *http.Request) { payload, err := io.ReadAll(r.Body) if err != nil { http.Error(w, "Unable to read request body", http.StatusBadRequest) return } signature := r.Header.Get("X-Xquik-Signature") if !verifySignature(payload, signature, webhookSecret) { ``` Duplicate Python example in `references/python-examples.md:153-158`: ```python def do_POST(self): length = int(self.headers.get("Content-Length", "0")) signature = self.headers.get("X-Xquik-Signature", "") payload = self.rfile.read(length) if not verify_signature(payload, signature, WEBHOOK_SECRET): ``` ### Technical Analysis Each handler reads the complete request body before authenticating the request through HMAC verification. None of the examples enforces a maximum body size. In Node.js, all incoming chunks are retained in an array and ...[truncated 2019 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (25)

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · references/mcp-setup.md (reported line 113)May include surrounding context.
store. Do not type the key into a shell command, save it in shell history, or put it in config.toml.

Use this ~/.codex/config.toml entry:

toml
[mcp_servers.xquik]

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · references/mcp-setup.md (reported line 239)May include surrounding context.
gemini mcp add --transport http xquik https://xquik.com/mcp

text
Or add it to `~/.gemini/settings.json` for user scope or `.gemini/settings.json` for project scope: ```json

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation states that the API key creation response returns the full secret key only once, but it does not explicitly warn that this value is a sensitive credential that must be stored securely and never logged, shared, or committed to source control. In an agent skill dealing with API access and automation, omission of this guidance increases the likelihood of accidental credential exposure and misuse.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file documents POST /drafts and delete functionality even though the skill metadata frames the capability set as read-only by default and says writes require explicit approval. This creates a scope mismatch that can mislead downstream agents or users into invoking state-changing actions without the expected consent boundary, increasing the risk of unauthorized content creation or deletion.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Draft creation and deletion are undeclared capabilities relative to the stated purpose of search, lookup, exports, monitoring, and approved publishing. Hidden or under-declared mutating functionality is dangerous because an agent integrating from documentation may exceed intended permissions and perform actions the user did not expect this skill to support.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file documents a state-changing POST /draws endpoint that executes a giveaway draw, which conflicts with the skill metadata stating the skill is read-only by default and that writes require explicit approval. In an agent setting, this mismatch can cause an LLM or integrator to invoke a write action without obtaining the required user consent, leading to unauthorized campaign actions or unintended use of metered/operational features.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation exposes a destructive delete operation that permanently removes monitors and all associated data, but it does not instruct the agent to require explicit user confirmation before invoking it. In an agent-skill context, missing confirmation guidance increases the risk of accidental or prompt-induced destructive actions, especially because monitors are persistent resources and their deletion affects ongoing tracking state and retained data.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest describes a skill centered on X/Twitter search, lookup, timelines, exports, monitoring, publishing, and MCP setup, with read-only behavior by default. This file documents a separate support-ticket system with create, update, and reply operations, which does not match the stated X/Twitter data-access purpose and introduces unrelated write behavior.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Managing support tickets is not an obvious requirement for a skill whose purpose is X/Twitter REST access, search, exports, monitoring, publishing, and MCP setup. The documented endpoints add an unrelated operational capability rather than implementing the declared social-data workflow.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file documents mutating endpoints (PUT /styles/{id} and delete /styles/{id}) even though the skill metadata says it is read-only by default and that writes require explicit approval. That mismatch can mislead an agent or user into performing state-changing actions without an approval gate, increasing the chance of unauthorized modification or deletion of cached style profiles.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The delete endpoint is destructive and is documented with no warning about irreversibility, confirmation requirements, or safeguards. In an agent setting, weakly signposted destructive actions increase the risk of accidental data loss, especially when the same endpoint accepts either a label or username and could remove cached profiles unexpectedly.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation exposes a destructive endpoint (DELETE /x/accounts/{id}) in a skill described as read-only by default and primarily oriented around search, lookup, and export workflows. Even though the doc says to confirm with the user, including account-disconnect behavior in the skill reference increases the chance an agent invokes or suggests a state-changing action outside the expected trust boundary, potentially disconnecting user accounts and disrupting service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation explicitly states that downloads are saved to shareable gallery pages and returns public gallery URLs, but it does not clearly warn users that requested tweet media and associated identifiers will be stored and exposed through link-based access. In a scraping/export skill, this omission can cause users to unintentionally submit sensitive, deleted-later, or restricted-context content into a persistent shareable location, creating a privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This document exposes numerous state-changing and privacy-sensitive endpoints, including tweeting, deleting content, sending DMs, following users, and modifying profiles, but it generally lacks consistent guidance requiring explicit user confirmation before execution. In an agent skill context, that omission is dangerous because an LLM or orchestrator may treat these actions as routine API calls and perform irreversible or reputation-damaging actions on a connected social account without clear consent boundaries.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This documentation exposes bulk extraction and export workflows for followers, likes, mentions, community members, and search results, but does not warn users about privacy, consent, platform-policy, or data-minimization implications. In the context of a Twitter/X scraping skill, missing guardrails can normalize large-scale collection and export of personal or behavioral data, increasing the risk of misuse for profiling, surveillance, or unauthorized data harvesting.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/mcp-setup.md (reported line 74)May include surrounding context.
md
4. Complete Xquik authorization and select **Create**. ChatGPT cannot present a custom API key. Business and Enterprise/Edu workspaces support full MCP, including write tools. Pro supports read and fetch tools only. Custom MCP apps are web-only. ### Codex CLI

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/mcp-setup.md (reported line 322)May include surrounding context.
md
Handle failures from structured error fields: - `401`: reconnect OAuth or replace the revoked API key. - `402`: report payment options. Never create checkout without confirmation. - `429`: honor `Retry-After`. - `5xx`: retry read-only requests with bounded exponential backoff.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file includes example code that sends API requests containing tweet identifiers and other request data to an external service, and later runs an HTTP server that accepts inbound webhook traffic. The document presents these behaviors as examples but does not include any warning about privacy, external data transmission, or the implications of opening a local server.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/security.md (reported line 36)May include surrounding context.
md
- the usage estimate when applicable - whether the action persists until disabled No approval is needed for safe documentation lookup, schema lookup, or read-only public data requests that the user clearly requested. ## Content Trust

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation exposes private-read endpoints and write-capable actions in the same workflow reference for a skill advertised as read-only by default and requiring explicit approval for sensitive operations. In an agent setting, ambiguous or caveat-free examples can lead downstream tooling or operators to invoke DMs, bookmarks, notifications, posting, follows, or profile changes without obtaining the required user confirmation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The delete endpoint is presented as a simple operation returning 204 No Content with no warning about destructive behavior, confirmation requirements, or recovery limitations. In an agent context, omission of such cautions makes accidental or automated destructive actions more likely, especially when combined with the broader scope ambiguity in the skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: The manifest describes X/Twitter REST and MCP capabilities centered on search, lookup, timelines, exports, monitoring, approved publishing, and similar operational tasks. This file documents a separate capability for caching, labeling, comparing, and performance-analyzing writing style profiles, which is not clearly declared in the manifest description.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The file introduces filterLanguage using an English example and the workflow later sets filterLanguage: "en", which can encourage enforcing a specific language for participant selection. Because no user opt-in, alternatives, or justification are described, this may conflict with language/locale policy expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This markdown file includes code that reads process.env.XQUIK_API_KEY, which is a sensitive credential access pattern. While the snippet is technically clear, the surrounding documentation does not warn users to protect the key or avoid exposing it in logs, shared scripts, or client-side contexts.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The endpoint guide lists sensitive private-read and write operations as ordinary capabilities without repeating the approval requirement stated elsewhere. In practice, terse capability tables are often consumed more directly than prose, so omission of the caveat increases the chance that an agent treats these actions as generally permitted.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.