Versioned security assessment

Report ID: SA-F93E9BB0

7/7/2026, 4:22:52 AM

twitter-automation security assessment v4

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
twitter-automation
Version
v4
Maintainer
skills-shell
Source
github.com/skills-shell/skills/tree/main/tools/social/twitter-automation/
Coverage
1 Files scanned · 158 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

2 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static findings are Markdown code spans or code fences, but several documented commands invoke the belt CLI, npx, or remote assets. No prompt injection text was found; the main risks are broad belt command permission and account-mutating Twitter/X automation.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 158 Lines analyzed

19 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 7 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 37 evidence locations

Capability review items (17)
Medium
SKILL.md:7
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
The line instructs users to install an external CLI skill through npx. That can fetch community code and is a supply-chain command execution risk.
Medium
SKILL.md:19-24
Ruby/shell backtick execution
```bash
The reported block includes belt login and a command to publish a tweet. It invokes a networked CLI with authenticated account side effects.
Medium
SKILL.md:45-47
Ruby/shell backtick execution
```bash
The reported block contains a belt command that publishes a tweet. This is an authenticated external account mutation.
Medium
SKILL.md:51-61
Ruby/shell backtick execution
```bash
The reported block creates sample input and publishes media through belt. It combines local file handling with an external posting action.
Medium
SKILL.md:65-67
Ruby/shell backtick execution
```bash
The reported block uses belt to like a tweet. This changes the connected Twitter/X account state through an external service.
Medium
SKILL.md:71-73
Ruby/shell backtick execution
```bash
The reported block uses belt to retweet a post. This performs an authenticated social account action.
Medium
SKILL.md:77-82
Ruby/shell backtick execution
```bash
The reported block sends a direct message through belt. Automated messages can expose private text or contact users unexpectedly.
Medium
SKILL.md:86-88
Ruby/shell backtick execution
```bash
The reported block follows a user through belt. This is an authenticated account mutation and can be abused for growth automation.
Medium
SKILL.md:92-94
Ruby/shell backtick execution
```bash
The reported block retrieves a user profile through the external CLI. It is read-only, but it still performs network access through belt.
Medium
SKILL.md:98-100
Ruby/shell backtick execution
```bash
The reported block retrieves tweet details through the external CLI. It is read-only, but it still performs network access through belt.
Medium
SKILL.md:104-106
Ruby/shell backtick execution
```bash
The reported block deletes a tweet through belt. This is a destructive authenticated account action.
Medium
SKILL.md:110-119
Ruby/shell backtick execution
```bash
The reported block generates an image, writes output to a file, and posts media through belt. It combines filesystem and network side effects.
Medium
SKILL.md:123-132
Ruby/shell backtick execution
```bash
The reported block generates a video and posts media through belt. It invokes third-party app workflows and publishes to a connected account.
Medium
SKILL.md:136-148
Ruby/shell backtick execution
```bash
The reported block recommends installing multiple external skills with npx. That expands supply-chain exposure beyond this skill.
Medium
SKILL.md:148-150
Ruby/shell backtick execution
```
The reported range includes an inline belt store command that contacts external app metadata. It is limited, but it is still a networked command.
Low
SKILL.md:13
Hardcoded URL
![Twitter/X Automation](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kgad3pxs
The Markdown image embeds a remote cloud.inference.sh asset. Rendering it can trigger a network request and disclose viewer metadata.
Low
SKILL.md:17
Hardcoded URL
> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer
The install instructions link to a raw GitHub file on a mutable branch. Users may follow remote setup content outside the reviewed skill.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 Medium
SKILL.md:4SKILL.md:150
Broad Belt CLI Permission Scope
The skill grants Bash access for all belt commands, while the content also encourages browsing the wider app store. This permission is broader than the listed Twitter/X workflows.
The allowed-tools entry permits any belt subcommand, and the skill explicitly references the app store. This creates a clear overbroad permission concern.
RISK-002 Medium
SKILL.md:31-38SKILL.md:75-87SKILL.md:102-105
Account-Mutating Social Automation
The skill supports posting, likes, retweets, direct messages, follows, and deletion. These actions can affect a connected account and can be abused for spam or unauthorized outreach.
The documented app list and examples directly include account-changing actions. The risk is contextual business-logic abuse rather than a syntax pattern.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    Broad belt command permission
    Limit allowed tool patterns to the specific Twitter/X belt commands needed by the skill. Require approval before any nonlisted belt command runs.
  2. FIX-002
    Medium
    Account-changing social actions
    Require explicit user confirmation before posting, deleting, liking, retweeting, following, or sending direct messages.
  3. FIX-003
    Medium
    Unpinned external setup and related skill installs
    Pin install references to reviewed versions and explain that related skills are separate trust decisions.
  4. FIX-004
    Low
    Remote image asset
    Host marketplace images through a reviewed asset pipeline or remove remote image embeds from the skill file.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable