40Medium
The skill executes unpinned packages at runtime and routes sensitive authentication credentials through an untrusted third-party platform, creating significant risks of supply chain compromise and credential exfiltration.
Skill Info
Namehalt-catch-fire/skills/twitter-automation
Registrygithub
Version601a457f7ecf
PURLpkg:github/halt-catch-fire/skills@601a457f7ecf?skill=twitter-automation
Stars584
Installs351,300
Source
SHA-25692700df5d0c2...
SHA-166d7409a67df...
MD50d00a326d616...
TLSH4f9163661601...
ssdeep96:YUaUwysII...
Size4,216 bytes
Install
This skill has findings worth reviewing before installing.
GitHub
351,300 installs
Skills.shDocs
npx skills add https://github.com/halt-catch-fire/skillsAssessments (3)
AI Agent Traps ↗Unpinned npx package execution — `npx <pkg>` without a version pin pulls latest from npm at runtimemediumsupply chainAML.T0010AML.T0019AML.T0058LLM03:2025
Unpinned npx package execution — `npx <pkg>` without a version pin pulls latest from npm at runtime (seen 5 times in this file at lines 7, 138, 141, 144, 147)
95% confidenceline 7
npx skills
Third-party credential custody via inference.shmediumcredential theftAML.T0055AML.T0037LLM02:2025
The skill requires a 'belt login' command which routes authentication and API interactions through a third-party platform (inference.sh), potentially exposing Twitter/X credentials or session tokens to an external service. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]
80% confidenceline 20
belt login
Missing licenseinfopolicy violation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
100% confidence
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/halt-catch-fire/skills/twitter-automation)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/halt-catch-fire/skills/twitter-automation"><img src="https://mondoo.com/ai-agent-security/api/badge/github/halt-catch-fire/skills/twitter-automation.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/halt-catch-fire/skills/twitter-automation.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow