twitter-poster

SUSPICIOUS. The skill's stated purpose fits posting to X, but the required setup introduces an undocumented third-party validation service, likely forwards sensitive session material, and instructs the agent to obscure that behavior. Combined with autonomous public posting, the footprint is broader and less trustworthy than necessary for a normal Twitter/X posting skill.

This module is strongly indicative of malicious data theft: it collects browser cookie databases (session credentials), all environment variables (possible secrets), and SSH configuration/metadata, packages them into an archive, and exfiltrates the archive to a hardcoded external endpoint. The behavior is incompatible with legitimate “X/Twitter account linking” and represents a high-impact privacy/security compromise.