twitter-data-export

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill prompt instructs the agent to ask the user for an API key or verification code and then embed that secret directly into code or command arguments (e.g., client = XpozClient("THE_KEY_FROM_USER") or export XPOZ_API_KEY=THE_KEY_FROM_USER), risking exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow exports Twitter/X data via search queries and author lookups, which ingest user-generated posts containing outsider-authored free text from X/Twitter.