x-twitter-research

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). This set of URLs points to an unofficial/typo-like domain (twitr.sh) that issues downloadable snapshot URLs (including a generic "https://…") — a non-official service that can host arbitrary files and is therefore a suspicious source for distributing executables or malware.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This document describes and enables bulk export of user data (followers, tweets, mentions, etc.) via an external API, which is a clear data-exfiltration capability that can be abused for mass harvesting of personal information.