profile-management
Fail
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: HIGHCOMMAND_EXECUTIONNO_CODEMETADATA_POISONING
Full Analysis
- [COMMAND_EXECUTION]: The skill provides detailed instructions for users to paste scripts directly into their browser's developer console while logged into
x.com. This technique, known as Self-XSS, enables arbitrary code to run within the user's authenticated session, which can be used to steal session tokens, credentials, or perform unauthorized actions. - [NO_CODE]: The core functionality of the skill is contained in external JavaScript files (
src/profileManager.js,src/updateProfile.js,src/qrCodeSharing.js, andsrc/followerGrowthTracker.js) that are referenced in the documentation but not included in the skill package. This lack of source code prevents any verification of the scripts' safety. - [METADATA_POISONING]: There is a discrepancy between the author specified in the skill metadata (
nichxbt) and the identified author context (nirholas), suggesting potential misrepresentation of the skill's origin.
Recommendations
- AI detected serious security threats
Audit Metadata