x-intelligence-automation

SUSPICIOUS: the skill’s purpose and capabilities mostly align, but its core data flow routes Twitter/X access and credentials through AIsa’s third-party relay instead of official X APIs. That relay-based mediation plus support for autonomous public actions makes the skill medium-high risk even without evidence of overt malware or malicious installation behavior.

The code implements a Twitter/X relay client and does not show clear malware indicators such as data theft beyond its stated relay function, persistence, command execution, reverse shells, or obfuscation. It does create a significant credential-handling risk: AISA_API_KEY is sent to a third-party relay, duplicated in the request body, and printed in output. Local media files and post content are also uploaded to that relay. The fragment additionally contains a syntax error as shown. The external service and credential exposure should be reviewed before use.