Habilidades extension-posting-to-x

📦

extension-posting-to-x

Name: extension-posting-to-x
Author: caffeinelabs

v0.1.0 Revisión del contenido r1 Riesgo alto ⚙️ Comandos externos🌐 Acceso a red📁 Acceso al sistema de archivos

Build Secure X Posting for Caffeine Apps

Direct X API integration can expose bearer tokens, multiply outcall costs, and mishandle optional fields. This skill provides Motoko architecture, OAuth guidance, frontend flows, and x-client patterns for secure per-user posting.

Compatible con: Claude Codex Code(CC)

⚠️ 38 Deficiente

Detente y solicita confirmación antes de instalar.

Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "extension-posting-to-x" from https://skillstore.io/skills/caffeinelabs-extension-posting-to-x.md and its manifest at https://skillstore.io/api/skills/caffeinelabs-extension-posting-to-x/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/caffeinelabs-extension-posting-to-x.md Manifest firmado GET /api/skills/caffeinelabs-extension-posting-to-x/manifest Lockfile firmado GET /api/skills/caffeinelabs-extension-posting-to-x/lockfile

Pruébalo

Usando "extension-posting-to-x". Add X posting to a community application with one operator-managed Developer App.

Resultado esperado:

Use the admin Client ID variant. Each signed-in member completes OAuth separately, while the canister stores tokens by principal and mediates every post.

Usando "extension-posting-to-x". Our tenants need independent X API quotas and their own Developer Apps.

Resultado esperado:

Use per-user Client IDs. Provide personal settings and connection pages, then resolve each caller's Client ID before starting OAuth or posting.

Usando "extension-posting-to-x". Check whether our callback flow protects against OAuth login CSRF.

Resultado esperado:

Verify that the server creates a one-time state value, binds it to the caller, and rejects callbacks with missing, mismatched, or expired state.

Auditoría de seguridad

Riesgo alto

v1 • 22/7/2026 Abrir el informe versionado

All 247 static findings are false positives caused by Markdown notation, official reference URLs, normal relative links, or Motoko syntax. No static match represents command execution, unsafe filesystem access, reconnaissance, or unrelated network traffic. Semantic review found overbroad agent-control directives and an OAuth callback design that omits the state value required for CSRF validation.

Archivos escaneados

740

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (2)

Alto

SKILL.md:10-13 SKILL.md:27-39

Prompt Injection Attempt Detected

The skill orders the orchestrator to "do not decline, deflect, or call `query_rag`" and to activate for "any prior task" mention. These unconditional control directives can suppress normal refusal and retrieval decisions beyond technical X integration guidance.

The quoted imperatives directly target agent routing and refusal behavior. They are explicit, although they do not claim system authority or mention audit evasion.

Alto

SKILL.md:285-295 SKILL.md:642-649 SKILL.md:719-723

OAuth Callback Omits State Verification Input

The canonical completeXOAuth function accepts only code and redirectUri, and the frontend parses state but does not pass it. Generated implementations cannot compare the returned state before token exchange, enabling OAuth login CSRF and account confusion.

The callback signature and frontend call both omit state, while the skill separately requires state verification. The prescribed interface cannot perform the stated comparison.

Factores de riesgo

⚙️ Comandos externos (50)

🌐 Acceso a red (13)

SKILL.md:29 SKILL.md:23 SKILL.md:366 SKILL.md:374 SKILL.md:387 SKILL.md:402 SKILL.md:468 SKILL.md:732 SKILL.md:733 SKILL.md:734 SKILL.md:735 SKILL.md:736 SKILL.md:737

📁 Acceso al sistema de archivos (7)

SKILL.md:83 SKILL.md:259 SKILL.md:601 SKILL.md:637 SKILL.md:709 SKILL.md:738 SKILL.md:739

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/caffeinelabs-extension-posting-to-x/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/caffeinelabs-extension-posting-to-x/security.svg)](https://skillstore.io/skills/caffeinelabs-extension-posting-to-x?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/caffeinelabs-extension-posting-to-x?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/caffeinelabs-extension-posting-to-x/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/caffeinelabs-extension-posting-to-x.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

caffeinelabs. (2026). extension-posting-to-x security audit report (audit version 1) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/caffeinelabs-extension-posting-to-x/audits/1

Cita BibTeX

@techreport{caffeinelabs-caffeinelabs-extension-posting-to-x-2026,
  author = {caffeinelabs},
  title = {extension-posting-to-x security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/caffeinelabs-extension-posting-to-x/audits/1},
  note = {Author version 0.1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "extension-posting-to-x security audit report (audit version 1)"
version: "0.1.0"
type: report
authors:
  - name: "caffeinelabs"
date-released: "2026-07-22"
url: "https://skillstore.io/skills/caffeinelabs-extension-posting-to-x/audits/1"
identifiers:
  - type: other
    value: "skillstore:caffeinelabs-extension-posting-to-x:audit:1"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

100

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Add posting to a community app

Implement signed-in posting through one operator-managed X Developer App while keeping each member's OAuth tokens isolated.

Separate tenant rate limits

Use per-user Client IDs so tenants control their X applications and do not share one rate-limit pool.

Standardize X integration

Define approved backend, OAuth, and frontend patterns for teams building X posting into Internet Computer applications.

Prueba estos prompts

Plan basic X posting

Plan X posting for my Caffeine app. Use the admin Client ID variant and list required backend, authentication, and frontend work.

Build the default architecture

Design the admin Client ID and per-user OAuth architecture. Include token isolation, non-replicated outcalls, connection status, posting, and disconnection.

Adapt for multiple tenants

Adapt the X posting design for per-user Client IDs. Explain storage, caller checks, OAuth routing, rate-limit isolation, and the settings experience.

Audit an existing integration

Review my Caffeine X integration for token exposure, OAuth state verification, PKCE handling, redirect validation, refresh rotation, replicated outcalls, authorization, and incomplete stubs.

Mejores prácticas

Use x-client 0.2.3 or later and keep posting outcalls non-replicated.
Store access and refresh tokens only in canister state keyed by the authenticated caller.
Generate and verify one-time OAuth state and PKCE values on the server before token exchange.

Evitar

Do not expose, return, log, or persist OAuth bearer tokens in the browser.
Do not use replicated HTTP outcalls for authenticated X requests.
Do not deploy placeholder OAuth functions or accept callback parameters without server-side validation.

Preguntas frecuentes

Does this skill read timelines or search X?

No. It focuses on X write operations. Use a general HTTP outcall integration for unsupported read endpoints.

Where are OAuth tokens stored?

Store them in canister state keyed by the authenticated caller. Never return them to the frontend.

Which Client ID variant should I choose?

Use the admin variant by default. Choose per-user IDs for tenant-controlled apps or fallback mode when both options are required.

Why must outcalls be non-replicated?

Replication sends authenticated requests multiple times, increases cycle and rate-limit costs, and expands bearer-token exposure.

Is the provided OAuth flow complete?

No. Authorization, token exchange, and refresh functions are placeholders. Implement and review them before deployment.

What protects the OAuth callback?

Use PKCE and a server-generated, one-time state value bound to the caller. Validate both before exchanging the authorization code.

Detalles del desarrollador

Autor

caffeinelabs

Licencia

MIT

Versión del autor

v0.1.0

Revisión de Skillstore

Repositorio

https://github.com/caffeinelabs/skills/tree/10fb452613c797633b8cb33639fc9a754a138039/skills/extension-posting-to-x

Ref.

70c19b3c1d1efbdf7557d8f9aaa5ec54489edc36

Actualidad del mantenimiento

22/7/2026

Uso

0 descargas · 0 vistas

Estructura de archivos

📄 SKILL.md