Versioned security assessment

Report ID: SA-8B5FFBE8

7/9/2026, 11:51:35 AM

twitter-automation security assessment v2

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
twitter-automation
Version
v2
Maintainer
101-skills
Source
github.com/101-skills/skills/tree/main/tools/social/twitter-automation/
Coverage
1 Files scanned · 158 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

2 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The static backtick detector produced many Markdown false positives; most table entries, code fences, and documentation links are not executable code. Risk remains because belt CLI commands can post, delete, DM, follow, like, and retweet through a connected X account. No prompt injection language was found in SKILL.md.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 158 Lines analyzed

17 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 7 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 37 evidence locations

Capability review items (15)
High
SKILL.md:77-82
Ruby/shell backtick execution
```bash
The example runs belt to send a direct message from the connected account. This can be abused for unsolicited or deceptive outreach, so the account-action risk is elevated.
Medium
SKILL.md:7
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
This line tells users to install an external CLI skill through npx, which can fetch third-party package code. The command is documented rather than automatic, so the risk is supply-chain exposure rather than direct injection.
Medium
SKILL.md:19-24
Ruby/shell backtick execution
```bash
The fenced example includes belt login and a belt command that can post to the connected X account. It is not command injection, but executing it delegates account-changing action to an external CLI.
Medium
SKILL.md:45-47
Ruby/shell backtick execution
```bash
The example runs belt to publish a tweet through the connected X account. The command is intentional documentation, but it has a real account-changing side effect if executed.
Medium
SKILL.md:51-61
Ruby/shell backtick execution
```bash
The example runs belt commands to create sample input and publish media through an external service. This is a real CLI workflow with account and filesystem side effects if executed.
Medium
SKILL.md:65-67
Ruby/shell backtick execution
```bash
The example runs belt to like a post from the connected account. That is an account-changing social action, so it is a real external-command risk if executed.
Medium
SKILL.md:71-73
Ruby/shell backtick execution
```bash
The example runs belt to retweet a post from the connected account. That is an account-changing social action, so it is a real external-command risk if executed.
Medium
SKILL.md:86-88
Ruby/shell backtick execution
```bash
The example runs belt to follow a user from the connected account. That is an account-changing social action, so it is a real external-command risk if executed.
Medium
SKILL.md:104-106
Ruby/shell backtick execution
```bash
The example runs belt to delete a tweet from the connected account. Deleting account content is a real destructive side effect if the command is executed.
Medium
SKILL.md:110-119
Ruby/shell backtick execution
```bash
The workflow runs external generation and X posting commands, writes output to a local file, and publishes media. This has network, filesystem, and account-changing side effects if executed.
Medium
SKILL.md:123-132
Ruby/shell backtick execution
```bash
The workflow runs external video generation and X posting commands, writes output to a local file, and publishes media. This has network, filesystem, and account-changing side effects if executed.
Medium
SKILL.md:136-148
Ruby/shell backtick execution
```bash
The block recommends installing additional external skills with npx from remote repositories. That creates supply-chain risk if users install unreviewed dependencies.
Low
SKILL.md:11
Hardcoded URL
Automate Twitter/X via [inference.sh](https://inference.sh) CLI.
The URL documents the external inference.sh service that the CLI uses, so the skill has a real third-party network dependency. The line is not exfiltration, so severity remains low.
Low
SKILL.md:13
Hardcoded URL
![Twitter/X Automation](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kgad3pxs
The Markdown image references a remote cloud.inference.sh asset that may be fetched by renderers. This is low-severity external content exposure, not evidence of data exfiltration.
Low
SKILL.md:17
Hardcoded URL
> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer
The line links to remote install instructions for the required CLI, creating a low-severity dependency on external hosted content. It is not an automatic fetch by the skill.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 High
SKILL.md:31-38SKILL.md:75-88SKILL.md:102-105
Social Account Abuse Potential
The skill documents actions that can post, delete, DM, follow, like, and retweet from a connected X account. These workflows can be abused for spam, impersonation, or unwanted account changes without approval controls.
The file explicitly lists and demonstrates mutating X actions, including DMs, follows, likes, retweets, posts, and deletion. The abuse risk is contextual rather than a simple syntax pattern.
RISK-002 Medium
SKILL.md:7SKILL.md:136-148
Unpinned Remote Skill Installation
The skill recommends installing external skills with npx and remote repository references. Unpinned installs can expose users to supply-chain changes outside this skill report.
The cited lines contain explicit npx skill installation commands without pinned versions or integrity verification. The risk depends on user execution, but the recommendation is clear.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Account-changing actions can run through belt commands.
    Require explicit confirmation before post, delete, DM, follow, like, or retweet actions. Show account, target, and content before execution.
  2. FIX-002
    High
    Engagement workflows can be abused for unsolicited outreach.
    Add anti-spam guidance, rate limits, and policy checks before DM, follow, like, or retweet actions.
  3. FIX-003
    Medium
    External skill and CLI installation commands are unpinned.
    Pin trusted package or skill versions and document verification steps before installing belt or related skills.
  4. FIX-004
    Medium
    Network and authentication boundaries are implicit.
    Document that commands use inference.sh and X integrations. Recommend test accounts or limited permissions for automation.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable