fxtwitter
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious code, obfuscation, or persistence mechanisms were detected in the skill scripts or instructions.
- [EXTERNAL_DOWNLOADS]: The skill performs HTTP GET requests to
api.fxtwitter.com(viascripts/fetch_tweet.py) to retrieve tweet metadata. This is the primary and documented function of the skill. - [PROMPT_INJECTION]: The skill processes untrusted content from X (Twitter) posts. While this creates a surface for indirect prompt injection, it is inherent to the skill's purpose of fetching and summarizing social media content. No malicious instructions were found in the skill's own prompts.
- [COMMAND_EXECUTION]: The skill uses a Python script to fetch data. Input validation is performed in
scripts/fetch_tweet.pyusing regular expressions to ensure only numeric IDs or valid status URLs are processed, preventing common injection vectors.
Audit Metadata