📦
Audit History
twitter-automation - 5 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v5 Latest | Jul 12, 2026, 10:22 AM | 2 confirmed | 15 | No capability change |
| v4 | Jul 12, 2026, 10:22 AM | 2 confirmed | 15 | No capability change |
| v3 | Jul 8, 2026, 02:06 PM | 2 confirmed | 16 | No capability change |
| v2 | Jul 9, 2026, 11:51 AM | 2 confirmed | 15 | No capability change |
| v1 | Jul 8, 2026, 02:06 PM | 2 confirmed | 16 | Baseline |
Audit version 5 Latest
Jul 12, 2026, 10:22 AM
The skill intentionally runs belt and npx commands, including authenticated Twitter/X actions and third-party skill installation. Markdown formatting and ordinary documentation links are false positives, but the remote image, unpinned installs, and missing action confirmations remain real risks.
1
Files scanned
158
Lines analyzed
19
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Account-changing actions lack confirmation safeguards
The skill directly instructs posting, liking, reposting, messaging, following, and deleting without requiring a preview or explicit confirmation before each action.
The cited command examples perform externally visible or destructive account actions, and no approval step appears in the skill.
Medium
Unpinned third-party skill installation
The skill recommends npx installations from repository names without a commit or immutable version, allowing future upstream changes to alter installed instructions.
The installation commands name repositories or skill aliases without immutable revisions. This creates a clear dependency integrity risk.
Capability review items (15)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
The line instructs users to run npx to download and install a third-party CLI skill. This is real external command execution with supply-chain exposure.
Medium
SKILL.md:19-24SKILL.md:45-47SKILL.md:51-61SKILL.md:65-67SKILL.md:71-73SKILL.md:77-82SKILL.md:86-88SKILL.md:92-94SKILL.md:98-100SKILL.md:104-106SKILL.md:110-119SKILL.md:123-132SKILL.md:136-148
Ruby/shell backtick execution · 13 occurrences
```bash
The fenced block runs belt login and an authenticated Twitter/X posting command. These are intentional external commands with account and network side effects.
Low
Hardcoded URL
SKILL.md:7 SKILL.md:17 SKILL.md:19-24 SKILL.md:24-31 SKILL.md:31-32 SKILL.md:32-33 SKILL.md:33-34 SKILL.md:34-35 SKILL.md:35-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38-39 SKILL.md:39-45 SKILL.md:45-47 SKILL.md:47-51 SKILL.md:51-61 SKILL.md:61-65 SKILL.md:65-67 SKILL.md:67-71 SKILL.md:71-73 SKILL.md:73-77 SKILL.md:77-82 SKILL.md:82-86 SKILL.md:86-88 SKILL.md:88-92 SKILL.md:92-94 SKILL.md:94-98 SKILL.md:98-100 SKILL.md:100-104 SKILL.md:104-106 SKILL.md:106-110 SKILL.md:110-119 SKILL.md:119-123 SKILL.md:123-132 SKILL.md:132-136 SKILL.md:136-148 SKILL.md:148-150
🌐 Network access (7)
Audited by: codex
Jul 12, 2026, 10:22 AM
The skill intentionally runs belt and npx commands, including authenticated Twitter/X actions and third-party skill installation. Markdown formatting and ordinary documentation links are false positives, but the remote image, unpinned installs, and missing action confirmations remain real risks.
1
Files scanned
158
Lines analyzed
19
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Account-changing actions lack confirmation safeguards
The skill directly instructs posting, liking, reposting, messaging, following, and deleting without requiring a preview or explicit confirmation before each action.
The cited command examples perform externally visible or destructive account actions, and no approval step appears in the skill.
Medium
Unpinned third-party skill installation
The skill recommends npx installations from repository names without a commit or immutable version, allowing future upstream changes to alter installed instructions.
The installation commands name repositories or skill aliases without immutable revisions. This creates a clear dependency integrity risk.
Capability review items (15)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
The line instructs users to run npx to download and install a third-party CLI skill. This is real external command execution with supply-chain exposure.
Medium
SKILL.md:19-24SKILL.md:45-47SKILL.md:51-61SKILL.md:65-67SKILL.md:71-73SKILL.md:77-82SKILL.md:86-88SKILL.md:92-94SKILL.md:98-100SKILL.md:104-106SKILL.md:110-119SKILL.md:123-132SKILL.md:136-148
Ruby/shell backtick execution · 13 occurrences
```bash
The fenced block runs belt login and an authenticated Twitter/X posting command. These are intentional external commands with account and network side effects.
Low
Hardcoded URL
SKILL.md:7 SKILL.md:17 SKILL.md:19-24 SKILL.md:24-31 SKILL.md:31-32 SKILL.md:32-33 SKILL.md:33-34 SKILL.md:34-35 SKILL.md:35-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38-39 SKILL.md:39-45 SKILL.md:45-47 SKILL.md:47-51 SKILL.md:51-61 SKILL.md:61-65 SKILL.md:65-67 SKILL.md:67-71 SKILL.md:71-73 SKILL.md:73-77 SKILL.md:77-82 SKILL.md:82-86 SKILL.md:86-88 SKILL.md:88-92 SKILL.md:92-94 SKILL.md:94-98 SKILL.md:98-100 SKILL.md:100-104 SKILL.md:104-106 SKILL.md:106-110 SKILL.md:110-119 SKILL.md:119-123 SKILL.md:123-132 SKILL.md:132-136 SKILL.md:136-148 SKILL.md:148-150
🌐 Network access (7)
Audited by: codex
Jul 8, 2026, 02:06 PM
The skill is documentation-only, but it includes actionable belt and npx commands for installing external skills and performing authenticated Twitter/X actions. I confirmed real command-execution and account-mutation examples, while marking markdown fences, app identifiers, and ordinary documentation links as false positives. No prompt injection text was found.
1
Files scanned
158
Lines analyzed
20
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Authenticated Twitter/X Account Actions
The skill describes posting, liking, retweeting, deleting, sending DMs, and following users from a connected account. These actions can cause public, private, or destructive account changes if run without clear user consent.
The app table and examples explicitly include mutating Twitter/X actions, including DMs, follows, posts, and deletion. The risk is contextual business-logic abuse rather than a code pattern.
Medium
Third-Party CLI Authentication Requirement
The quick start requires users to authenticate with the belt CLI before running Twitter/X commands. Connected account tokens or session state are therefore entrusted to the external CLI and service.
The quick-start text requires the belt CLI and shows belt login before posting. The exact credential storage model is not shown, so the finding is limited to the documented authentication dependency.
Capability review items (16)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
This line instructs users to run npx to install an external CLI skill package. That executes code from the package ecosystem and is a real supply-chain risk.
Medium
SKILL.md:19-24SKILL.md:45-47SKILL.md:51-61SKILL.md:65-67SKILL.md:71-73SKILL.md:77-82SKILL.md:86-88SKILL.md:92-94SKILL.md:98-100SKILL.md:104-106SKILL.md:110-119SKILL.md:123-132SKILL.md:136-148
Ruby/shell backtick execution · 13 occurrences
```bash
The fenced block contains belt login and a belt app run command that can authenticate and post to a connected Twitter/X account. This is legitimate functionality, but it is real external command execution.
Medium
Ruby/shell backtick execution
```
The finding range includes an inline belt app store command after the closing fence. It appears read-only, but it still directs execution of an external CLI.
Low
Hardcoded URL
SKILL.md:7 SKILL.md:17 SKILL.md:19-24 SKILL.md:24-31 SKILL.md:31-32 SKILL.md:32-33 SKILL.md:33-34 SKILL.md:34-35 SKILL.md:35-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38-39 SKILL.md:39-45 SKILL.md:45-47 SKILL.md:47-51 SKILL.md:51-61 SKILL.md:61-65 SKILL.md:65-67 SKILL.md:67-71 SKILL.md:71-73 SKILL.md:73-77 SKILL.md:77-82 SKILL.md:82-86 SKILL.md:86-88 SKILL.md:88-92 SKILL.md:92-94 SKILL.md:94-98 SKILL.md:98-100 SKILL.md:100-104 SKILL.md:104-106 SKILL.md:106-110 SKILL.md:110-119 SKILL.md:119-123 SKILL.md:123-132 SKILL.md:132-136 SKILL.md:136-148 SKILL.md:148-150
🌐 Network access (7)
Audited by: codex
Jul 9, 2026, 11:51 AM
The static backtick detector produced many Markdown false positives; most table entries, code fences, and documentation links are not executable code. Risk remains because belt CLI commands can post, delete, DM, follow, like, and retweet through a connected X account. No prompt injection language was found in SKILL.md.
1
Files scanned
158
Lines analyzed
19
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Social Account Abuse Potential
The skill documents actions that can post, delete, DM, follow, like, and retweet from a connected X account. These workflows can be abused for spam, impersonation, or unwanted account changes without approval controls.
The file explicitly lists and demonstrates mutating X actions, including DMs, follows, likes, retweets, posts, and deletion. The abuse risk is contextual rather than a simple syntax pattern.
Medium
Unpinned Remote Skill Installation
The skill recommends installing external skills with npx and remote repository references. Unpinned installs can expose users to supply-chain changes outside this skill report.
The cited lines contain explicit npx skill installation commands without pinned versions or integrity verification. The risk depends on user execution, but the recommendation is clear.
Capability review items (15)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Ruby/shell backtick execution
```bash
The example runs belt to send a direct message from the connected account. This can be abused for unsolicited or deceptive outreach, so the account-action risk is elevated.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
This line tells users to install an external CLI skill through npx, which can fetch third-party package code. The command is documented rather than automatic, so the risk is supply-chain exposure rather than direct injection.
Medium
SKILL.md:19-24SKILL.md:45-47SKILL.md:51-61SKILL.md:65-67SKILL.md:71-73SKILL.md:86-88SKILL.md:104-106SKILL.md:110-119SKILL.md:123-132SKILL.md:136-148
Ruby/shell backtick execution · 10 occurrences
```bash
The fenced example includes belt login and a belt command that can post to the connected X account. It is not command injection, but executing it delegates account-changing action to an external CLI.
Low
Hardcoded URL
Automate Twitter/X via [inference.sh](https://inference.sh) CLI.
The URL documents the external inference.sh service that the CLI uses, so the skill has a real third-party network dependency. The line is not exfiltration, so severity remains low.
Low
Hardcoded URL
. [Install instructions](https://raw.githubusercontent.com/infer
The line links to remote install instructions for the required CLI, creating a low-severity dependency on external hosted content. It is not an automatic fetch by the skill.
Risk Factors
⚙️ External commands (37)
SKILL.md:7 SKILL.md:17 SKILL.md:19-24 SKILL.md:24-31 SKILL.md:31-32 SKILL.md:32-33 SKILL.md:33-34 SKILL.md:34-35 SKILL.md:35-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38-39 SKILL.md:39-45 SKILL.md:45-47 SKILL.md:47-51 SKILL.md:51-61 SKILL.md:61-65 SKILL.md:65-67 SKILL.md:67-71 SKILL.md:71-73 SKILL.md:73-77 SKILL.md:77-82 SKILL.md:82-86 SKILL.md:86-88 SKILL.md:88-92 SKILL.md:92-94 SKILL.md:94-98 SKILL.md:98-100 SKILL.md:100-104 SKILL.md:104-106 SKILL.md:106-110 SKILL.md:110-119 SKILL.md:119-123 SKILL.md:123-132 SKILL.md:132-136 SKILL.md:136-148 SKILL.md:148-150
🌐 Network access (7)
Audited by: codex
Jul 8, 2026, 02:06 PM
The skill is documentation-only, but it includes actionable belt and npx commands for installing external skills and performing authenticated Twitter/X actions. I confirmed real command-execution and account-mutation examples, while marking markdown fences, app identifiers, and ordinary documentation links as false positives. No prompt injection text was found.
1
Files scanned
158
Lines analyzed
20
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Authenticated Twitter/X Account Actions
The skill describes posting, liking, retweeting, deleting, sending DMs, and following users from a connected account. These actions can cause public, private, or destructive account changes if run without clear user consent.
The app table and examples explicitly include mutating Twitter/X actions, including DMs, follows, posts, and deletion. The risk is contextual business-logic abuse rather than a code pattern.
Medium
Third-Party CLI Authentication Requirement
The quick start requires users to authenticate with the belt CLI before running Twitter/X commands. Connected account tokens or session state are therefore entrusted to the external CLI and service.
The quick-start text requires the belt CLI and shows belt login before posting. The exact credential storage model is not shown, so the finding is limited to the documented authentication dependency.
Capability review items (16)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
This line instructs users to run npx to install an external CLI skill package. That executes code from the package ecosystem and is a real supply-chain risk.
Medium
SKILL.md:19-24SKILL.md:45-47SKILL.md:51-61SKILL.md:65-67SKILL.md:71-73SKILL.md:77-82SKILL.md:86-88SKILL.md:92-94SKILL.md:98-100SKILL.md:104-106SKILL.md:110-119SKILL.md:123-132SKILL.md:136-148
Ruby/shell backtick execution · 13 occurrences
```bash
The fenced block contains belt login and a belt app run command that can authenticate and post to a connected Twitter/X account. This is legitimate functionality, but it is real external command execution.
Medium
Ruby/shell backtick execution
```
The finding range includes an inline belt app store command after the closing fence. It appears read-only, but it still directs execution of an external CLI.
Low
Hardcoded URL
SKILL.md:7 SKILL.md:17 SKILL.md:19-24 SKILL.md:24-31 SKILL.md:31-32 SKILL.md:32-33 SKILL.md:33-34 SKILL.md:34-35 SKILL.md:35-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38-39 SKILL.md:39-45 SKILL.md:45-47 SKILL.md:47-51 SKILL.md:51-61 SKILL.md:61-65 SKILL.md:65-67 SKILL.md:67-71 SKILL.md:71-73 SKILL.md:73-77 SKILL.md:77-82 SKILL.md:82-86 SKILL.md:86-88 SKILL.md:88-92 SKILL.md:92-94 SKILL.md:94-98 SKILL.md:98-100 SKILL.md:100-104 SKILL.md:104-106 SKILL.md:106-110 SKILL.md:110-119 SKILL.md:119-123 SKILL.md:123-132 SKILL.md:132-136 SKILL.md:136-148 SKILL.md:148-150
🌐 Network access (7)
Audited by: codex