aisa-twitter-api

SUSPICIOUS. The skill's purpose and capabilities are broadly coherent for a Twitter/X integration, and there is no download-execute installer or unverifiable binary. However, all reads and writes are intentionally routed through AIsa's relay instead of official Twitter/X endpoints, so user requests, media, and the required API credential flow to a third-party intermediary by design. That relay-based data flow is proportionate to the stated purpose but creates meaningful trust and privacy risk, especially since the referenced local Python clients are not provided here for verification.

The intended behavior is a Twitter/X posting client using the AIsa relay service, with local media upload and OAuth authorization. No clear malware, backdoor, destructive behavior, code execution, or system-data exfiltration is present. However, the API key is unnecessarily included in request bodies and is explicitly printed in command results, constituting a significant credential-disclosure risk. The code also contains visible syntax errors as supplied, so execution requires correction. The third-party relay and its handling of credentials and media should be trusted and independently verified.