x-twitter
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a documentation-only 'Data Skill' that provides instructions and operation mappings for an external service (UnifAPI). It does not include any executable scripts (.py, .js, .sh), which significantly reduces the attack surface.
- [SAFE]: The skill explicitly defines a 'read-only' posture ('eyes, not hands'), stating that it never posts, replies, follows, or DMs. This aligns with the provided operation list, which only includes data retrieval endpoints (e.g.,
x/users/by/username,x/tweets/search/recent). - [SAFE]: All external references, including the homepage, source code repository, and documentation links, point to the legitimate vendor domain
unifapi.comor theunifapi-agentGitHub organization. There are no signs of typosquatting or redirection to untrusted third-party sites. - [SAFE]: No sensitive information such as API keys or bearer tokens are hardcoded. The skill relies on a separate
unifapiskill for OAuth connection, which is a best practice for secret management. - [SAFE]: There are no indicators of prompt injection, obfuscation, persistence mechanisms, or unauthorized privilege escalation.
Audit Metadata