keyapi-twitter
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local Node.js scripts to automate the configuration of environment variables and the execution of REST API calls. The
configure-keyapi-auth.mjsscript modifies shell configuration files (such as.bashrc,.zshrc, and PowerShell profiles) to store theKEYAPI_TOKENfor persistence across sessions. - [DATA_EXFILTRATION]: The skill transmits API tokens and request data to the vendor's official endpoint at
https://api.keyapi.ai. This is the intended behavior for the service and is used to retrieve Twitter/X content. - [SAFE]: The skill demonstrates security awareness by instructing the agent never to print or restate the
KEYAPI_TOKEN. All external URLs and resources belong to the verified vendor domainkeyapi.ai. The scripts rely on Node.js built-in modules, avoiding third-party dependency risks. - [PROMPT_INJECTION]: The skill identifies a potential indirect prompt injection surface as it ingests untrusted content from Twitter/X. It mitigates this by providing clear instructions to the agent to separate observed API facts from inference and to follow analytical reporting rules.
Audit Metadata