twitter-autopilot

SUSPICIOUS: The skill’s capabilities match its stated Twitter automation purpose, but its data flow is routed entirely through AIsa rather than official X APIs. That third-party gateway model plus autonomous public posting/engagement creates elevated trust and account-action risk, though the skill does not show overt malware behavior or deceptive installation steps.

This is a readable Twitter/X relay client with no clear evidence of malware, obfuscation, persistence, command execution, or covert exfiltration. It intentionally transmits API credentials, post data, and selected media to an external service. The API key is unnecessarily printed and duplicated in request bodies, while the configurable base URL permits credential transmission to arbitrary HTTP(S) hosts. Restrict the relay host, require HTTPS, avoid printing or embedding the key unnecessarily, and correct the apparent class-definition syntax issue.

The visible code appears to be a purpose-built Twitter engagement CLI rather than malware. It contains a significant credential-disclosure issue because status outputs the AISA API key, and raw responses may expose additional data. The two unterminated --label help strings are syntax errors that prevent execution as provided. Assessment of imported Twitter and relay modules is required to evaluate their network behavior, but no malicious behavior is evident in this fragment.