Versioned security assessment

Report ID: SA-4121DE96

8/6/2026, 12:11:17 PM

twitter-automation security assessment v5

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: codex Latest published report
Skill name
twitter-automation
Version
v5
Maintainer
infsh-skills
Source
github.com/infsh-skills/skills/tree/main/tools/social/twitter-automation/
Coverage
1 Files scanned · 158 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

Medium

2 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The skill intentionally invokes inference.sh commands that can publish, delete, message, follow, and engage through an external X account. Most static alerts are Markdown syntax, but unpinned skill installation, a remote image, and automation abuse potential remain material concerns.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Active attestation

A public attestation is available for this exact report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 158 Lines analyzed

18 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 7 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 37 evidence locations

Capability review items (16)
Medium
SKILL.md:7
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
Line 7 instructs users to run an unpinned npx command that downloads another skill. This crosses a supply-chain boundary even though Markdown backticks do not execute it automatically.
Medium
SKILL.md:19-24
Ruby/shell backtick execution
```bash
The Bash block runs belt login and posts a tweet through an external account. These are intended external commands with authentication and public side effects.
Medium
SKILL.md:45-47
Ruby/shell backtick execution
```bash
The fenced example invokes belt to publish a tweet. It is a legitimate command, but it creates an external public side effect.
Medium
SKILL.md:51-61
Ruby/shell backtick execution
```bash
This Bash block invokes belt, writes input.json, and publishes media through X. The commands have local filesystem and external account side effects.
Medium
SKILL.md:65-67
Ruby/shell backtick execution
```bash
The Bash example runs belt to like a specified tweet. This intentionally changes engagement state on an external account.
Medium
SKILL.md:71-73
Ruby/shell backtick execution
```bash
The Bash example invokes belt to retweet a specified post. This is an intended external command with a public account side effect.
Medium
SKILL.md:77-82
Ruby/shell backtick execution
```bash
The Bash block invokes belt to send a direct message to a specified recipient. This transmits user-provided content to an external party.
Medium
SKILL.md:86-88
Ruby/shell backtick execution
```bash
The Bash example invokes belt to follow a named user. This changes the authenticated account through an external service.
Medium
SKILL.md:92-94
Ruby/shell backtick execution
```bash
The Bash example invokes belt to retrieve a user profile from X. It intentionally runs an external command and transmits a username.
Medium
SKILL.md:98-100
Ruby/shell backtick execution
```bash
The Bash example invokes belt to retrieve tweet details from X. This is intended external command and network activity.
Medium
SKILL.md:104-106
Ruby/shell backtick execution
```bash
The Bash example invokes belt to delete a specified tweet. This is an external command with a destructive account side effect.
Medium
SKILL.md:110-119
Ruby/shell backtick execution
```bash
The workflow invokes a remote image-generation app, writes output to image.json, and posts media to X. It performs external commands with filesystem and public side effects.
Medium
SKILL.md:123-132
Ruby/shell backtick execution
```bash
The workflow invokes a remote video-generation app, writes output to video.json, and posts media to X. It has filesystem, network, and public account effects.
Medium
SKILL.md:136-148
Ruby/shell backtick execution
```bash
The Bash block runs four unpinned npx installation commands for remote skills. Executing them introduces code and instruction supply-chain exposure.
Low
SKILL.md:13
Hardcoded URL
![Twitter/X Automation](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kgad3pxs
The Markdown embeds an image hosted on cloud.inference.sh. Rendering it can automatically disclose network metadata to that external host.
Low
SKILL.md:17
Hardcoded URL
> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer
The link directs users to installation instructions on a mutable raw GitHub branch. Following those instructions introduces an external trust and supply-chain dependency.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 Medium
SKILL.md:7SKILL.md:136-147
Unpinned Remote Skill Installation
The skill instructs users to install remote skills through npx without immutable versions or commits, allowing upstream changes to alter installed instructions.
The commands visibly reference package and repository names without version or commit pins. This is direct evidence of a mutable dependency boundary.
RISK-002 Medium
SKILL.md:3SKILL.md:75-88
Social Platform Abuse Potential
The stated engagement-bot and audience-growth use cases combine with direct-message and follow commands, enabling unsolicited outreach or coordinated engagement.
The metadata explicitly promotes engagement bots and audience growth, while the examples provide direct-message and follow operations without consent or rate-limit controls.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    The installation examples fetch skills without pinning an immutable version or commit.
    Pin every package and remote skill to a reviewed version or commit, and document how users can verify its integrity.
  2. FIX-002
    Medium
    Several commands create irreversible or public account actions.
    Require explicit confirmation before posting, deleting, liking, retweeting, messaging, or following, and display the target account and content.
  3. FIX-003
    Medium
    Automated direct messages and follows can be used for spam or platform abuse.
    Add consent, rate-limit, audience-selection, and X policy checks before bulk or repeated engagement actions.
  4. FIX-004
    Low
    The documentation embeds an image from an external host.
    Bundle a local reviewed image or disclose that rendering the documentation may contact inference.sh.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
4121de961d1b6f2ffca856260e239505c302452c
Content hash
84a02a31e425c3729fa243114323eeeffa01b2713a8e496a8aeb3f68bec83af2
Tree hash
c97112b03c10416e0715b4c79cf1f75fc9c82d16ccf87f69ad24f5e999cc9f1c
Skill path
skills/infsh-skills/twitter-automation
Audit payload hash
b78bd0eaaddbf5e55de89c9507ab9a43

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: active