articles-longform
Fail
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill refers to external script files (
src/articlePublisher.js,src/contentRepurposer.js, andsrc/tweetPerformance.js) that are missing from the provided skill bundle. Instructing a user or agent to execute unprovided, opaque code is a major security risk. - [COMMAND_EXECUTION]: The instructions explicitly guide the user to bypass standard interface protections by opening browser DevTools (F12) and pasting scripts into the console while authenticated on
x.com. This pattern, known as self-XSS, is a frequent vector for malicious actors to execute commands in the context of a user's logged-in session. - [DATA_EXFILTRATION]: The skill mentions scripts designed to track performance and repurpose content (
src/tweetPerformance.js). Without access to the source code, it is impossible to verify if these scripts access and transmit private account data, session tokens, or cookie information to unauthorized external servers.
Recommendations
- AI detected serious security threats
Audit Metadata