x-twitter-research

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). This is a third‑party, non‑official domain (twitr.sh) that exposes API endpoints which return arbitrary download URLs for datasets—potentially hosting executables or archives—and resembles a typosquat of a major service, so it should be treated as suspicious for distributing downloads.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This document describes and enables bulk export of user data (followers, tweets, mentions, etc.) via an external API, which is a clear data-exfiltration capability that can be abused for mass harvesting of personal information.