X Twitter

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:30 PM UTC
• Version: 1.0.1

Overview

This skill is mostly an X API helper, but it needs review because its optional save feature can overwrite arbitrary local files and its credential guidance is weak.

Install only if you are comfortable giving the skill an X API bearer token and local file-write ability. Prefer a temporary or secret-manager-provided token instead of putting it in shell startup files, use a least-privileged X app token, and avoid --save paths outside a dedicated output directory until the overwrite behavior is constrained.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/search_tweets.py:139
• Finding: Arbitrary File Overwrite Through Unrestricted Save Path in Tweet Search## Vulnerability Details **File Location**: `scripts/search_tweets.py`, lines 139-142 **Vulnerability Type**: Unrestricted file write / arbitrary file overwrite **Risk Level**: Medium **Vulnerable Code:** ```python # Save to file if args.save: with open(args.save, 'w', encoding='utf-8') as f: json.dump(result, f, indent=2, ensure_ascii=False) ``` ### Technical Analysis The value of `args.save` is accepted directly from the `--save` command-line argument and passed to `open()` in truncating write mode. No restriction confines output to an intended directory, and there are no checks for absolute paths, parent-directory traversal, symbolic links, or existing sensitive files. This permits the script to overwrite any file writable by its operating-system user. The vulnerability becomes exploitable when an attacker can influence the arguments used by an agent or automation system to invoke the Skill. ### Attack Path 1. An attacker supplies content that causes the agent to invoke `search_tweets.py` with a malicious `--save` path. 2. The path identifies an existing writable configuration, workspace, script, or other sensitive file. 3. The script makes the expected request to X and receives a JSON response. 4. `open(args.save, 'w', ...)` truncates the targeted file. 5. The API response is written over the original contents. ### Impact Assessment The attacker does not gain permissions beyond those of the process running the Skill, but can affect any file writable by that account. Likely consequences include workspace corruption, destruction of configuration, denial of service, and manipulation of files consumed by other applications. Further impact may occur if the overwritten content is subsequently interpreted by a security-sensitive component.
• Remediation: ## Remediation Suggestions - Write only beneath a dedicated output directory controlled by the Skill. - Resolve the requested path with `pathlib.Path.resolve()` and verify that it remains beneath the approved directory. - Reject absolute paths, traversal outside the output directory, symbolic links, and special files. - Prefer exclusive creation with mode `x` unless overwriting is explicitly requested and confirmed. - Apply restrictive permissions to newly created output files. - If arbitrary destinations are genuinely required, require explicit trusted-user approval before replacing an existing file.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/get_article.py:194
• Finding: Arbitrary File Overwrite Through Unrestricted Save Path in Article Retrieval## Vulnerability Details **File Location**: `scripts/get_article.py`, lines 194-197 **Vulnerability Type**: Unrestricted file write / arbitrary file overwrite **Risk Level**: Medium **Vulnerable Code:** ```python # Save to file if args.save: with open(args.save, 'w', encoding='utf-8') as f: json.dump(data, f, indent=2, ensure_ascii=False) print(f"\n💾 Saved to: {args.save}") ``` ### Technical Analysis The attacker-influenced `--save` value is used as a filesystem path without validation. Opening it with mode `w` creates a missing file or immediately truncates an existing one. The implementation does not enforce a safe output root or protect against absolute paths, `..` traversal, or symbolic-link redirection. The article URL itself is not fetched directly: it is only parsed for an identifier, and the bearer token remains directed to the fixed `api.x.com` endpoint. The vulnerability is therefore the unrestricted local write, not credential exfiltration through the supplied URL. ### Attack Path 1. An attacker influences an agent invocation to include `--save` with a sensitive writable path. 2. The script extracts or accepts a tweet identifier and requests its data from X. 3. After receiving the response, the script opens the attacker-selected destination in truncating mode. 4. The existing target contents are destroyed and replaced with the returned JSON data. 5. Applications relying on the overwritten file may fail or process attacker-influenced data. ### Impact Assessment Exploitation is limited to the filesystem privileges of the Skill process. Within that boundary, an attacker can corrupt workspace data, configuration files, generated artifacts, or other writable resources. This can cause denial of service and potentially more serious downstream effects where another component trusts or interprets the overwritten file.
• Remediation: ## Remediation Suggestions - Define a dedicated output directory and prohibit writes outside it. - Canonicalize the destination before opening it and verify containment within the approved directory. - Reject absolute paths, traversal components, symbolic links, and non-regular files. - Use exclusive file creation by default to avoid silently replacing existing content. - Where replacement is necessary, require an explicit overwrite option and trusted-user confirmation. - Consider generating safe filenames internally from the retrieved tweet ID rather than accepting arbitrary paths.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/get_trends.py:161
• Finding: Arbitrary File Overwrite Through Unrestricted Save Path in Trend Retrieval## Vulnerability Details **File Location**: `scripts/get_trends.py`, lines 161-164 **Vulnerability Type**: Unrestricted file write / arbitrary file overwrite **Risk Level**: Medium **Vulnerable Code:** ```python # Save to file if args.save: with open(args.save, 'w', encoding='utf-8') as f: json.dump(data, f, indent=2, ensure_ascii=False) print(f"\n💾 Saved to: {args.save}") ``` ### Technical Analysis The trend retrieval script passes the unvalidated `--save` argument directly to `open()` using truncating write mode. Consequently, any file writable by the process can be created or replaced. No path allowlist, output-directory confinement, symbolic-link defense, or overwrite confirmation is implemented. The network request itself uses HTTPS and sends `X_BEARER_TOKEN` only to the fixed official `https://api.x.com/2` API origin. Supplying that credential to X is necessary for the declared trend-fetching functionality. The static sensitive-network pattern does not, by itself, demonstrate unauthorized exfiltration. ### Attack Path 1. An attacker causes an agent or automation workflow to run `get_trends.py` with an attacker-selected `--save` path. 2. The script retrieves trend data from the configured X API endpoint. 3. The destination is opened with mode `w`, truncating any existing writable file. 4. The response JSON replaces the target contents. 5. The overwrite causes data loss, configuration corruption, or downstream application failure. ### Impact Assessment The issue does not elevate the process to higher operating-system privileges. It does, however, violate least-access expectations for output generation by allowing modification of every path writable by the current account instead of only an intended result directory. The principal impacts are data destruction, configuration corruption, and denial of service, with possible downstream consequences if another component consumes the resulting fi ...[truncated 3 chars]
• Remediation: ## Remediation Suggestions - Constrain saved results to a dedicated, least-privileged output directory. - Resolve and validate the canonical destination path before opening the file. - Reject destinations outside the approved root, including paths reached through symbolic links. - Avoid silent truncation by using exclusive creation or requiring an explicit overwrite flag. - Verify that the destination is a regular file and apply restrictive file permissions. - Use an internally generated filename based on the WOEID and timestamp when a caller does not require a trusted explicit name.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: Claiming unsupported article retrieval, trend fetching, and OAuth behavior misrepresents what the skill can do and obscures real runtime behavior. In an agent setting, inaccurate capability claims are security-relevant because they impair policy review and may cause inappropriate credential scoping or unjustified trust in the skill.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Claiming unsupported article retrieval, trend fetching, and OAuth behavior misrepresents what the skill can do and obscures real runtime behavior. In an agent setting, inaccurate capability claims are security-relevant because they impair policy review and may cause inappropriate credential scoping or unjustified trust in the skill.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Claiming unsupported article retrieval, trend fetching, and OAuth behavior misrepresents what the skill can do and obscures real runtime behavior. In an agent setting, inaccurate capability claims are security-relevant because they impair policy review and may cause inappropriate credential scoping or unjustified trust in the skill.

Session Persistence

Medium

• Category: Rogue Agent

Content

Set the `X_BEARER_TOKEN` environment variable:

```bash
# Add to ~/.bashrc or ~/.zshrc
export X_BEARER_TOKEN="your_bearer_token_here"

# Reload

• Confidence: 90% confidence
• Finding: The README advises storing the X bearer token in ~/.bashrc or ~/.zshrc, which creates long-lived credential persistence in plaintext shell startup files. If those files are exposed through backups, local compromise, overbroad permissions, or accidental sharing, the token can be stolen and used to access the associated X API account and consume quota or access data.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation instructs users to set and use a bearer token but provides no warning about protecting secrets from shell history, logs, saved files, screenshots, or accidental commits. In practice, API tokens are high-value credentials, and casual handling guidance materially increases the likelihood of credential leakage and unauthorized API use.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The module docstring and CLI description present the tool as handling both articles and tweets, and the URL parser accepts article-style URLs. However, the implementation always invokes /tweets/{id} and the formatter only handles tweet-shaped response data, so article retrieval is not actually implemented.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: Comments and user-facing descriptions explicitly describe article handling, including parsing x.com/user/article/ID URLs. In practice, the extracted ID is passed to get_tweet_by_id, which performs only tweet lookup, so the documentation actively overstates the implemented behavior.

External Transmission

Medium

• Category: Data Exfiltration

Content

def __init__(self, bearer_token=None):
        self.bearer_token = bearer_token or os.environ.get('X_BEARER_TOKEN')
        self.base_url = "https://api.x.com/2"

        if not self.bearer_token:
            raise ValueError("Bearer Token not found. Set X_BEARER_TOKEN environment variable")

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

def __init__(self, bearer_token=None):
        self.bearer_token = bearer_token or os.environ.get('X_BEARER_TOKEN')
        self.base_url = "https://api.x.com/2"

        if not self.bearer_token:
            raise ValueError("Bearer Token not found. Set X_BEARER_TOKEN environment variable")

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

def __init__(self, bearer_token=None):
        self.bearer_token = bearer_token or os.environ.get('X_BEARER_TOKEN')
        self.base_url = "https://api.x.com/2"

        if not self.bearer_token:
            raise ValueError("Bearer Token not found. Set X_BEARER_TOKEN environment variable")

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The README advertises a `--save` option for search results but does not warn users that enabling it will write fetched content to disk. For markdown files, missing warnings about behaviors that can affect user data or system state should be called out, even when the operation is optional.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The `--save` option for article retrieval indicates the skill can persist fetched content locally, but the documentation does not disclose that this may store user-requested or third-party content on disk. The markdown description should warn about data persistence when behavior could affect privacy or local system state.

Static analysis

No suspicious patterns detected.