twitter-cli-skill
Fail
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill automates the extraction of sensitive authentication tokens (TWITTER_AUTH_TOKEN, TWITTER_CT0) and session cookies directly from browser storage (Arc, Chrome, Edge, Firefox, Brave) to bypass official API requirements.
- [EXTERNAL_DOWNLOADS]: The instructions require the installation of the 'twitter-cli' package from an untrusted third-party GitHub repository (jackwener/twitter-cli) and PyPI.
- [PRIVILEGE_ESCALATION]: The troubleshooting section provides specific instructions to unlock the macOS keychain ('security unlock-keychain') and grant terminal applications access to browser 'Safe Storage' within Keychain Access, which are actions that bypass standard security boundaries for protected secrets.
- [COMMAND_EXECUTION]: The skill relies on executing shell commands to interact with the local filesystem and browser databases to retrieve credentials.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data from Twitter feeds, search results, and bookmarks into the agent's context, creating a surface for injection attacks.
- Ingestion points: 'twitter feed', 'twitter search', 'twitter bookmarks', and 'twitter user-posts' commands.
- Boundary markers: None identified in the provided instructions or command outputs.
- Capability inventory: The skill has extensive write capabilities including posting tweets, replying, following/unfollowing users, and deleting content.
- Sanitization: No sanitization or filtering of the fetched tweet content is described.
Recommendations
- AI detected serious security threats
Audit Metadata