Skills extension-posting-to-x

📦

extension-posting-to-x

Name: extension-posting-to-x
Author: caffeinelabs

v0.1.0 Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Build Secure X Posting for Caffeine Apps

Direct X API integration can expose bearer tokens, multiply outcall costs, and mishandle optional fields. This skill provides Motoko architecture, OAuth guidance, frontend flows, and x-client patterns for secure per-user posting.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "extension-posting-to-x" from https://skillstore.io/skills/caffeinelabs-extension-posting-to-x.md and its manifest at https://skillstore.io/api/skills/caffeinelabs-extension-posting-to-x/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/caffeinelabs-extension-posting-to-x.md Signed manifest GET /api/skills/caffeinelabs-extension-posting-to-x/manifest Signed lockfile GET /api/skills/caffeinelabs-extension-posting-to-x/lockfile

Test it

Using "extension-posting-to-x". Add X posting to a community application with one operator-managed Developer App.

Expected outcome:

Use the admin Client ID variant. Each signed-in member completes OAuth separately, while the canister stores tokens by principal and mediates every post.

Using "extension-posting-to-x". Our tenants need independent X API quotas and their own Developer Apps.

Expected outcome:

Use per-user Client IDs. Provide personal settings and connection pages, then resolve each caller's Client ID before starting OAuth or posting.

Using "extension-posting-to-x". Check whether our callback flow protects against OAuth login CSRF.

Expected outcome:

Verify that the server creates a one-time state value, binds it to the caller, and rejects callbacks with missing, mismatched, or expired state.

Security Audit

High Risk

v1 • 7/22/2026 Open versioned report

All 247 static findings are false positives caused by Markdown notation, official reference URLs, normal relative links, or Motoko syntax. No static match represents command execution, unsafe filesystem access, reconnaissance, or unrelated network traffic. Semantic review found overbroad agent-control directives and an OAuth callback design that omits the state value required for CSRF validation.

Files scanned

740

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:10-13 SKILL.md:27-39

Prompt Injection Attempt Detected

The skill orders the orchestrator to "do not decline, deflect, or call `query_rag`" and to activate for "any prior task" mention. These unconditional control directives can suppress normal refusal and retrieval decisions beyond technical X integration guidance.

The quoted imperatives directly target agent routing and refusal behavior. They are explicit, although they do not claim system authority or mention audit evasion.

High

SKILL.md:285-295 SKILL.md:642-649 SKILL.md:719-723

OAuth Callback Omits State Verification Input

The canonical completeXOAuth function accepts only code and redirectUri, and the frontend parses state but does not pass it. Generated implementations cannot compare the returned state before token exchange, enabling OAuth login CSRF and account confusion.

The callback signature and frontend call both omit state, while the skill separately requires state verification. The prescribed interface cannot perform the stated comparison.

Risk Factors

⚙️ External commands (50)

🌐 Network access (13)

SKILL.md:29 SKILL.md:23 SKILL.md:366 SKILL.md:374 SKILL.md:387 SKILL.md:402 SKILL.md:468 SKILL.md:732 SKILL.md:733 SKILL.md:734 SKILL.md:735 SKILL.md:736 SKILL.md:737

📁 Filesystem access (7)

SKILL.md:83 SKILL.md:259 SKILL.md:601 SKILL.md:637 SKILL.md:709 SKILL.md:738 SKILL.md:739

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/caffeinelabs-extension-posting-to-x/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/caffeinelabs-extension-posting-to-x/security.svg)](https://skillstore.io/skills/caffeinelabs-extension-posting-to-x?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/caffeinelabs-extension-posting-to-x?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/caffeinelabs-extension-posting-to-x/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/caffeinelabs-extension-posting-to-x.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

caffeinelabs. (2026). extension-posting-to-x security audit report (audit version 1) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/caffeinelabs-extension-posting-to-x/audits/1

BibTeX citation

@techreport{caffeinelabs-caffeinelabs-extension-posting-to-x-2026,
  author = {caffeinelabs},
  title = {extension-posting-to-x security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/caffeinelabs-extension-posting-to-x/audits/1},
  note = {Author version 0.1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "extension-posting-to-x security audit report (audit version 1)"
version: "0.1.0"
type: report
authors:
  - name: "caffeinelabs"
date-released: "2026-07-22"
url: "https://skillstore.io/skills/caffeinelabs-extension-posting-to-x/audits/1"
identifiers:
  - type: other
    value: "skillstore:caffeinelabs-extension-posting-to-x:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Add posting to a community app

Implement signed-in posting through one operator-managed X Developer App while keeping each member's OAuth tokens isolated.

Separate tenant rate limits

Use per-user Client IDs so tenants control their X applications and do not share one rate-limit pool.

Standardize X integration

Define approved backend, OAuth, and frontend patterns for teams building X posting into Internet Computer applications.

Try These Prompts

Plan basic X posting

Plan X posting for my Caffeine app. Use the admin Client ID variant and list required backend, authentication, and frontend work.

Build the default architecture

Design the admin Client ID and per-user OAuth architecture. Include token isolation, non-replicated outcalls, connection status, posting, and disconnection.

Adapt for multiple tenants

Adapt the X posting design for per-user Client IDs. Explain storage, caller checks, OAuth routing, rate-limit isolation, and the settings experience.

Audit an existing integration

Review my Caffeine X integration for token exposure, OAuth state verification, PKCE handling, redirect validation, refresh rotation, replicated outcalls, authorization, and incomplete stubs.

Best Practices

Use x-client 0.2.3 or later and keep posting outcalls non-replicated.
Store access and refresh tokens only in canister state keyed by the authenticated caller.
Generate and verify one-time OAuth state and PKCE values on the server before token exchange.

Avoid

Do not expose, return, log, or persist OAuth bearer tokens in the browser.
Do not use replicated HTTP outcalls for authenticated X requests.
Do not deploy placeholder OAuth functions or accept callback parameters without server-side validation.

Frequently Asked Questions

Does this skill read timelines or search X?

No. It focuses on X write operations. Use a general HTTP outcall integration for unsupported read endpoints.

Where are OAuth tokens stored?

Store them in canister state keyed by the authenticated caller. Never return them to the frontend.

Which Client ID variant should I choose?

Use the admin variant by default. Choose per-user IDs for tenant-controlled apps or fallback mode when both options are required.

Why must outcalls be non-replicated?

Replication sends authenticated requests multiple times, increases cycle and rate-limit costs, and expands bearer-token exposure.

Is the provided OAuth flow complete?

No. Authorization, token exchange, and refresh functions are placeholders. Implement and review them before deployment.

What protects the OAuth callback?

Use PKCE and a server-generated, one-time state value bound to the caller. Validate both before exchanging the authorization code.

Developer Details

Author

caffeinelabs

License

MIT

Author version

v0.1.0

Skillstore revision

Repository

https://github.com/caffeinelabs/skills/tree/10fb452613c797633b8cb33639fc9a754a138039/skills/extension-posting-to-x

Ref

70c19b3c1d1efbdf7557d8f9aaa5ec54489edc36

Maintenance freshness

7/22/2026

Usage

0 downloads · 0 views

File structure

📄 SKILL.md