twitter-x-reply-scraper
Fail
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSPROMPT_INJECTIONCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructions attempt to subvert user oversight by requiring the agent to install dependencies "automatically without asking the user to confirm" and explicitly telling the agent "do not request separate approval for dependency installation."
- [EXTERNAL_DOWNLOADS]: The agent is directed to download software from an external source (browseract.com) to satisfy runtime requirements without user interaction.
- [REMOTE_CODE_EXECUTION]: The instruction to automatically install a missing CLI tool from a remote URL constitutes a remote code execution risk, as the installed software could execute arbitrary code on the host system upon invocation.
- [COMMAND_EXECUTION]: The core functionality relies on invoking the "browser-act" CLI, which executes shell commands on the user's system.
- [PROMPT_INJECTION]: The skill lacks security boundaries for processing untrusted external data (Twitter/X replies), making it susceptible to indirect prompt injection attacks.
- Ingestion points: External Twitter/X URLs defined in SKILL.md.
- Boundary markers: None identified in the instructions.
- Capability inventory: CLI execution via the "browser-act" tool.
- Sanitization: No evidence of data validation or sanitization of the scraped content.
Recommendations
- AI detected serious security threats
Audit Metadata