x-web-api

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). scripts/x-web-api.mjs loads and parses HTML/JSON bundles from X Web endpoints (e.g., getViewer→discoverOperation→client.text("/home") and publicText(main bundle URL) and subsequent GraphQL responses), so outsider-authored content can be ingested at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill fetches https://x.com/home and then downloads the X web main bundle from https://abs.twimg.com (matched by the script regex) at runtime and parses that remote JS/HTML to discover GraphQL query IDs and feature toggles which directly control the agent's API requests and behavior.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the repository for literal high-entropy credentials. I found one high-entropy bearer token hardcoded in the runtime code:
• scripts/x-web-api.mjs: lines 21-22 define PUBLIC_BEARER = "AAAAAAAAA....", which is a long, random-looking OAuth2 bearer token that the code uses in the Authorization header. This is a literal credential that could be used to access the service and therefore qualifies as a secret.

Ignored items:

• scripts/x-web-api.test.mjs:19 ("fixture-password") is a test fixture (low-entropy, clearly a test value) so it is ignored.
• The string "saltysalt" used as a PBKDF2 salt and other small fixed strings (e.g., "v10", ".x.com", user-agent) are known constants/format markers and not secrets, so they are ignored.