المهارات extension-posting-to-x

📦

extension-posting-to-x

Name: extension-posting-to-x
Author: caffeinelabs

v0.1.0 مراجعة المحتوى r1 مخاطر عالية ⚙️ الأوامر الخارجية🌐 الوصول إلى الشبكة📁 الوصول إلى نظام الملفات

Build Secure X Posting for Caffeine Apps

Direct X API integration can expose bearer tokens, multiply outcall costs, and mishandle optional fields. This skill provides Motoko architecture, OAuth guidance, frontend flows, and x-client patterns for secure per-user posting.

يدعم: Claude Codex Code(CC)

⚠️ 38 ضعيف

توقف واطلب التأكيد قبل التثبيت.

راجع الخطة واحصل على موافقة صريحة من المستخدم قبل تغيير الملفات.

التثبيت باستخدام Agent لدي

انسخ هذا الطلب إلى Agent لديك. يتضمن صفحة Skill المعتمدة وملف manifest.

طلب الوكيل

Review the Skillstore skill "extension-posting-to-x" from https://skillstore.io/skills/caffeinelabs-extension-posting-to-x.md and its manifest at https://skillstore.io/api/skills/caffeinelabs-extension-posting-to-x/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

يجب أن يواصل Agent عرض خطته وطلب أي تأكيد تفرضه سياسة الأمان.

موارد مهيّأة لـ Agents

استخدم هذه الروابط عندما يحتاج AI Agent أو crawler أو script إلى سياق نظيف بدلًا من قراءة الصفحة كاملة.

تفاصيل Markdown GET /skills/caffeinelabs-extension-posting-to-x.md manifest موقَّع GET /api/skills/caffeinelabs-extension-posting-to-x/manifest lockfile موقَّع GET /api/skills/caffeinelabs-extension-posting-to-x/lockfile

اختبرها

جارٍ استخدام "extension-posting-to-x". Add X posting to a community application with one operator-managed Developer App.

النتيجة المتوقعة:

Use the admin Client ID variant. Each signed-in member completes OAuth separately, while the canister stores tokens by principal and mediates every post.

جارٍ استخدام "extension-posting-to-x". Our tenants need independent X API quotas and their own Developer Apps.

النتيجة المتوقعة:

Use per-user Client IDs. Provide personal settings and connection pages, then resolve each caller's Client ID before starting OAuth or posting.

جارٍ استخدام "extension-posting-to-x". Check whether our callback flow protects against OAuth login CSRF.

النتيجة المتوقعة:

Verify that the server creates a one-time state value, binds it to the caller, and rejects callbacks with missing, mismatched, or expired state.

التدقيق الأمني

مخاطر عالية

v1 • ٢٢‏/٧‏/٢٠٢٦ فتح التقرير المرتبط بالإصدار

All 247 static findings are false positives caused by Markdown notation, official reference URLs, normal relative links, or Motoko syntax. No static match represents command execution, unsafe filesystem access, reconnaissance, or unrelated network traffic. Semantic review found overbroad agent-control directives and an OAuth callback design that omits the state value required for CSRF validation.

الملفات التي تم فحصها

740

الأسطر التي تم تحليلها

عناصر المراجعة

تم تجاهل الإيجابيات الكاذبة

مخاوف أمنية مؤكدة (2)

مرتفع

SKILL.md:10-13 SKILL.md:27-39

Prompt Injection Attempt Detected

The skill orders the orchestrator to "do not decline, deflect, or call `query_rag`" and to activate for "any prior task" mention. These unconditional control directives can suppress normal refusal and retrieval decisions beyond technical X integration guidance.

The quoted imperatives directly target agent routing and refusal behavior. They are explicit, although they do not claim system authority or mention audit evasion.

مرتفع

SKILL.md:285-295 SKILL.md:642-649 SKILL.md:719-723

OAuth Callback Omits State Verification Input

The canonical completeXOAuth function accepts only code and redirectUri, and the frontend parses state but does not pass it. Generated implementations cannot compare the returned state before token exchange, enabling OAuth login CSRF and account confusion.

The callback signature and frontend call both omit state, while the skill separately requires state verification. The prescribed interface cannot perform the stated comparison.

عوامل الخطر

⚙️ الأوامر الخارجية (50)

🌐 الوصول إلى الشبكة (13)

SKILL.md:29 SKILL.md:23 SKILL.md:366 SKILL.md:374 SKILL.md:387 SKILL.md:402 SKILL.md:468 SKILL.md:732 SKILL.md:733 SKILL.md:734 SKILL.md:735 SKILL.md:736 SKILL.md:737

📁 الوصول إلى نظام الملفات (7)

SKILL.md:83 SKILL.md:259 SKILL.md:601 SKILL.md:637 SKILL.md:709 SKILL.md:738 SKILL.md:739

دقّقه: codex

شارك واستشهد بهذا التقرير

شارك تقرير التقييم المرتبط بالإصدار والشارة المحايدة وبطاقة التضمين والاستشهادات. تعرض Skillstore الأدلة من دون أن تقرر ما إذا كانت هذه المهارة آمنة.

فتح التقرير المرتبط بالإصدار

نسخ رابط التقرير

https://skillstore.io/skills/caffeinelabs-extension-posting-to-x/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

شارة Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/caffeinelabs-extension-posting-to-x/security.svg)](https://skillstore.io/skills/caffeinelabs-extension-posting-to-x?utm_source=security_passport_badge)

شارة HTML

<a href="https://skillstore.io/skills/caffeinelabs-extension-posting-to-x?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/caffeinelabs-extension-posting-to-x/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

بطاقة قابلة للتضمين

<iframe src="https://skillstore.io/embed/skills/caffeinelabs-extension-posting-to-x.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

الاستشهادات الأكاديمية (APA · BibTeX · CFF)

اقتباس APA

caffeinelabs. (2026). extension-posting-to-x security audit report (audit version 1) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/caffeinelabs-extension-posting-to-x/audits/1

اقتباس BibTeX

@techreport{caffeinelabs-caffeinelabs-extension-posting-to-x-2026,
  author = {caffeinelabs},
  title = {extension-posting-to-x security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/caffeinelabs-extension-posting-to-x/audits/1},
  note = {Author version 0.1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "extension-posting-to-x security audit report (audit version 1)"
version: "0.1.0"
type: report
authors:
  - name: "caffeinelabs"
date-released: "2026-07-22"
url: "https://skillstore.io/skills/caffeinelabs-extension-posting-to-x/audits/1"
identifiers:
  - type: other
    value: "skillstore:caffeinelabs-extension-posting-to-x:audit:1"
    description: "Skillstore immutable audit report identifier"

تقييم Skillstore

سبب هذا التقييم موثوقية الأدلة: متوسط

الهندسة المعمارية

100

قابلية الصيانة

المحتوى

المجتمع

الامتثال للمواصفات

ما الذي يمكنك بناؤه

Add posting to a community app

Implement signed-in posting through one operator-managed X Developer App while keeping each member's OAuth tokens isolated.

Separate tenant rate limits

Use per-user Client IDs so tenants control their X applications and do not share one rate-limit pool.

Standardize X integration

Define approved backend, OAuth, and frontend patterns for teams building X posting into Internet Computer applications.

جرّب هذه الموجّهات

Plan basic X posting

Plan X posting for my Caffeine app. Use the admin Client ID variant and list required backend, authentication, and frontend work.

Build the default architecture

Design the admin Client ID and per-user OAuth architecture. Include token isolation, non-replicated outcalls, connection status, posting, and disconnection.

Adapt for multiple tenants

Adapt the X posting design for per-user Client IDs. Explain storage, caller checks, OAuth routing, rate-limit isolation, and the settings experience.

Audit an existing integration

Review my Caffeine X integration for token exposure, OAuth state verification, PKCE handling, redirect validation, refresh rotation, replicated outcalls, authorization, and incomplete stubs.

أفضل الممارسات

Use x-client 0.2.3 or later and keep posting outcalls non-replicated.
Store access and refresh tokens only in canister state keyed by the authenticated caller.
Generate and verify one-time OAuth state and PKCE values on the server before token exchange.

تجنب

Do not expose, return, log, or persist OAuth bearer tokens in the browser.
Do not use replicated HTTP outcalls for authenticated X requests.
Do not deploy placeholder OAuth functions or accept callback parameters without server-side validation.

الأسئلة المتكررة

Does this skill read timelines or search X?

No. It focuses on X write operations. Use a general HTTP outcall integration for unsupported read endpoints.

Where are OAuth tokens stored?

Store them in canister state keyed by the authenticated caller. Never return them to the frontend.

Which Client ID variant should I choose?

Use the admin variant by default. Choose per-user IDs for tenant-controlled apps or fallback mode when both options are required.

Why must outcalls be non-replicated?

Replication sends authenticated requests multiple times, increases cycle and rate-limit costs, and expands bearer-token exposure.

Is the provided OAuth flow complete?

No. Authorization, token exchange, and refresh functions are placeholders. Implement and review them before deployment.

What protects the OAuth callback?

Use PKCE and a server-generated, one-time state value bound to the caller. Validate both before exchanging the authorization code.

تفاصيل المطور

المؤلف

caffeinelabs

الترخيص

MIT

إصدار المؤلف

v0.1.0

مراجعة Skillstore

المستودع

https://github.com/caffeinelabs/skills/tree/10fb452613c797633b8cb33639fc9a754a138039/skills/extension-posting-to-x

مرجع

70c19b3c1d1efbdf7557d8f9aaa5ec54489edc36

حداثة الصيانة

٢٣‏/٧‏/٢٠٢٦

الاستخدام

0 تنزيلات · 0 مشاهدات

بنية الملفات

📄 SKILL.md