Skills twitter-automation
📦

twitter-automation

Content revision r1 Critical ⚙️ External commands🌐 Network access

Automate Twitter and X Workflows

Social teams often repeat posting and engagement tasks across X accounts. This skill guides Claude, Codex, and Claude Code through inference.sh commands for posting, engagement, DMs, follows, and profile lookups.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "twitter-automation" from https://skillstore.io/skills/inference-sh-twitter-automation.md and its manifest at https://skillstore.io/api/skills/inference-sh-twitter-automation/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/inference-sh-twitter-automation.md Signed manifest GET /api/skills/inference-sh-twitter-automation/manifest Signed lockfile GET /api/skills/inference-sh-twitter-automation/lockfile

Test it

Using "twitter-automation". Post an announcement for a new API guide.

Expected outcome:

Suggested post: New API guide is live. Learn the key setup steps and integration tips in one place. Approval needed before publishing.

Using "twitter-automation". Create a media post from a product image URL.

Expected outcome:

  • Caption prepared for the product image.
  • Media URL attached for review.
  • Next step: confirm the caption and media rights before publishing.

Using "twitter-automation". Engage with three customer posts.

Expected outcome:

Recommended actions: like the support thank-you, retweet the launch mention, and review the unclear complaint before responding.

Security Audit

Critical
v4 • 7/6/2026 Open versioned report

The skill is documentation-style, but it directs users and agents to execute external inference.sh commands that can modify an authenticated X account. The remote installer pattern on line 22 is a confirmed critical risk, while many Markdown backtick hits are false positives for fences or app identifiers. Semantic review also found abuse risk from automated posting, DMs, follows, likes, retweets, and deletes without explicit safeguards.

1
Files scanned
158
Lines analyzed
14
Review items
0
False positives ignored

Confirmed security concerns (3)

Critical
SKILL.md:22
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh && infsh login
The command pipes a remote script directly into sh before login. This can execute arbitrary code from the remote endpoint without verification.
High
SKILL.md:4-8SKILL.md:32-39
Automated Social Media Abuse Potential
The skill advertises social media automation, engagement bots, and audience growth, then exposes posting, likes, retweets, DMs, follows, and deletes. Without safeguards, these actions can enable spam, platform manipulation, or unwanted contact.
The stated use cases and app list explicitly include engagement automation and account actions. The risk is semantic because abuse depends on how the workflow is used.
High
SKILL.md:76-88SKILL.md:103-119
Authenticated Account Actions Lack Safety Controls
The examples perform DMs, follows, deletes, posts, and media workflows without documented approval gates, dry runs, rate limits, or policy checks. Accidental execution could publish, delete, or contact users from an authenticated account.
The cited examples show account-changing commands and no nearby safeguards. The risk is high because these actions affect public content and private messaging.
Capability review items (14)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
SKILL.md:22
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh && infsh login
The URL is used as a remote installer fetched by curl and piped into sh. That creates a real network-based code execution risk.
Medium
SKILL.md:20-26
Ruby/shell backtick execution
```bash
The quick-start block instructs users to execute shell commands, including a remote installer and account login. The pattern is Markdown-based, but the surrounding block is executable guidance.
Medium
SKILL.md:46-48
Ruby/shell backtick execution
```bash
The block contains an infsh command that posts content to X. This is intended functionality, but it executes an external CLI with authenticated account side effects.
Medium
SKILL.md:52-62
Ruby/shell backtick execution
```bash
The block samples input creation and then runs x/post-create through infsh. It performs an external CLI action that can publish media content.
Medium
SKILL.md:66-68
Ruby/shell backtick execution
```bash
The block includes an infsh command to like a tweet by ID. This uses an external service and changes authenticated account engagement state.
Medium
SKILL.md:72-74
Ruby/shell backtick execution
```bash
The block includes an infsh command to retweet a post. This is an external account action with public engagement impact.
Medium
SKILL.md:78-83
Ruby/shell backtick execution
```bash
The block includes an infsh command to send a direct message. This can contact another user from an authenticated X account.
Medium
SKILL.md:87-89
Ruby/shell backtick execution
```bash
The block includes an infsh command to follow a user. This changes authenticated account relationships on an external platform.
Medium
SKILL.md:93-95
Ruby/shell backtick execution
```bash
The block runs infsh to retrieve a user profile. It is read-only, but still invokes an external CLI and network-backed service.
Medium
SKILL.md:99-101
Ruby/shell backtick execution
```bash
The block runs infsh to retrieve tweet details. It is read-only, but still relies on an external command and remote service.
Medium
SKILL.md:105-107
Ruby/shell backtick execution
```bash
The block includes an infsh command to delete a tweet. This can remove public content from an authenticated account.
Medium
SKILL.md:111-120
Ruby/shell backtick execution
```bash
The workflow runs infsh to generate an image and then post it to X. It chains external service calls with public account publishing.
Medium
SKILL.md:124-133
Ruby/shell backtick execution
```bash
The workflow runs infsh to generate a video and then post it to X. It chains external service calls with public account publishing.
Medium
SKILL.md:137-149
Ruby/shell backtick execution
```bash
The related-skills block shows npx commands that install additional skills. These are external package and skill installation commands.

Risk Factors

⚙️ External commands (35)
SKILL.md:20-26 SKILL.md:26-32 SKILL.md:32-33 SKILL.md:33-34 SKILL.md:34-35 SKILL.md:35-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38-39 SKILL.md:39-40 SKILL.md:40-46 SKILL.md:46-48 SKILL.md:48-52 SKILL.md:52-62 SKILL.md:62-66 SKILL.md:66-68 SKILL.md:68-72 SKILL.md:72-74 SKILL.md:74-78 SKILL.md:78-83 SKILL.md:83-87 SKILL.md:87-89 SKILL.md:89-93 SKILL.md:93-95 SKILL.md:95-99 SKILL.md:99-101 SKILL.md:101-105 SKILL.md:105-107 SKILL.md:107-111 SKILL.md:111-120 SKILL.md:120-124 SKILL.md:124-133 SKILL.md:133-137 SKILL.md:137-149 SKILL.md:149-151
🌐 Network access (6)
SKILL.md:16 SKILL.md:22 SKILL.md:58 SKILL.md:155 SKILL.md:156 SKILL.md:157

Detected Patterns

Pipe to shell pattern
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/inference-sh-twitter-automation/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/inference-sh-twitter-automation/security.svg)](https://skillstore.io/skills/inference-sh-twitter-automation?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/inference-sh-twitter-automation?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/inference-sh-twitter-automation/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/inference-sh-twitter-automation.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

inference-sh. (2026). twitter-automation security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/inference-sh-twitter-automation/audits/4

BibTeX citation

@techreport{inference-sh-inference-sh-twitter-automation-2026, author = {inference-sh}, title = {twitter-automation security audit report (audit version 4)}, institution = {Skillstore}, year = {2026}, number = {4}, url = {https://skillstore.io/skills/inference-sh-twitter-automation/audits/4}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "twitter-automation security audit report (audit version 4)" version: "unspecified" type: report authors: - name: "inference-sh" date-released: "2026-07-06" url: "https://skillstore.io/skills/inference-sh-twitter-automation/audits/4" identifiers: - type: other value: "skillstore:inference-sh-twitter-automation:audit:4" description: "Skillstore immutable audit report identifier"

Compare variants

16 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score
sickn33 Recommended

sickn33-twitter-automation

Skillstore Score 70
Evidence Confidence High
Skillstore usage 7
Updated

2026-08-21

inferen-sh

inferen-sh-twitter-automation

Skillstore Score 69
Evidence Confidence High
Skillstore usage 8
Updated

2026-08-21

skillssh

skillssh-twitter-automation

Skillstore Score 50
Evidence Confidence High
Skillstore usage 8
Updated

2026-08-21

infsh-skills

infsh-skills-twitter-automation

Skillstore Score 50
Evidence Confidence High
Skillstore usage 7
Updated

2026-08-21

skills-shell

skills-shell-twitter-automation

Skillstore Score 50
Evidence Confidence Medium
Skillstore usage 5
Updated

2026-08-21

101-skills

101-skills-twitter-automation

Skillstore Score 50
Evidence Confidence Medium
Skillstore usage 5
Updated

2026-08-21

qu-skills

qu-skills-twitter-automation

Skillstore Score 50
Evidence Confidence Medium
Skillstore usage 4
Updated

2026-08-21

tul-sh

tul-sh-twitter-automation

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 11
Updated

2026-08-21

toolshell

toolshell-twitter-automation

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 11
Updated

2026-08-21

inference-sh Current

inference-sh-twitter-automation

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 9
Updated

2026-08-21

inference-shell

inference-shell-twitter-automation

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 9
Updated

2026-08-21

inference-sh-8

inference-sh-8-twitter-automation

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 8
Updated

2026-08-21

halt-catch-fire

halt-catch-fire-twitter-automation

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 8
Updated

2026-08-21

inference-skills

inference-skills-twitter-automation

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 5
Updated

2026-08-21

inference-sh-skills

inference-sh-skills-twitter-automation

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 5
Updated

2026-08-21

inference-sh-9

inference-sh-9-twitter-automation

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 4
Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance

What You Can Build

Publish Campaign Posts

Draft and publish approved X updates through inference.sh app commands.

Share Generated Media

Post generated images or videos to X after reviewing the caption and media URL.

Manage Account Engagement

Prepare likes, retweets, follows, and direct messages for approved community interactions.

Try These Prompts

Post a Text Update 
Use this skill to draft a concise X post about [topic]. Ask me to approve the final text before running any posting command.
Create a Media Post 
Prepare an X post for this media URL: [url]. Recommend concise alt text and confirm before using x/post-create.
Engage With Posts 
Given these post IDs: [ids], recommend which items to like or retweet. Run only the actions I approve.
Build a Launch Workflow 
Create a launch workflow that drafts posts, checks brand and policy constraints, requests approval, then uses inference.sh for approved X actions.

Best Practices

  • Review every post, DM, follow, like, retweet, and delete before execution.
  • Use least-privilege X accounts and keep inference.sh credentials protected.
  • Check platform rules, brand guidelines, media rights, and user consent before publishing.

Avoid

  • Do not run bulk engagement or unsolicited DM workflows without human approval.
  • Do not pipe remote installers into a shell without independent verification.
  • Do not publish generated media unless ownership and content safety are confirmed.

Frequently Asked Questions

Does this skill post directly to X?
Yes. It documents inference.sh commands that can post to an authenticated X account.
Does it require an external account?
Yes. You need inference.sh access and a configured Twitter/X integration.
Can it send direct messages?
Yes. The skill includes an inference.sh app command for sending X direct messages.
Can it work with images or videos?
Yes. It shows media post workflows that use media URLs from generated assets.
Does it include safety approvals?
No. Users should add approval, rate-limit, and policy checks before running actions.
Why is installation a concern?
The quick start pipes a remote installer into a shell, which can execute unverified code.

Developer Details

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/inference-sh/skills/tree/main/skills/twitter-automation/

Ref

a06681402992ceae98ba04d54cfd4ab004862696

Maintenance freshness

7/18/2026

Usage

5 downloads · 189 views

File structure

📄 SKILL.md