This skill allows arbitrary file reads and writes, risking data
Claims to do
FxTwitter Tools: - **read_tweet**: Fetch a single tweet by URL or ID. Returns text, media, polls, quotes, engagement stats. - **read_thread**: Unroll a complete thread into readable markdown. Accepts one or more tweet URLs. - **read_user**: Fetch a user profile by URL, @handle, or username. - **download_media**: Save images/videos from a tweet to the local filesystem. - **analyze_media**: Extract text from images using OCR (local file path or image URL).
Actually does
This skill provides five tools: `read_tweet` to fetch tweet data by URL/ID, `read_thread` to unroll threads into markdown, `read_user` to fetch user profiles, `download_media` to save tweet media to the local filesystem, and `analyze_media` to extract text from images using OCR.
The 'analyze_media' tool explicitly accepts a local file path, allowing the agent to read arbitrary files from the host filesystem. This poses a severe risk for reconnaissance and potential data exfiltration.
analyze_media: Extract text from images using OCR (local file path or image URL).
The 'download_media' tool can save files to the local filesystem. If the destination path is not properly sanitized or restricted, this could lead to arbitrary file writes, resource exhaustion, or planting malicious files.
download_media: Save images/videos from a tweet to the local filesystem.
[](https://mondoo.com/ai-agent-security/skills/github/wcfcarolina13/X-Scraper-MCP/fxtwitter)<a href="https://mondoo.com/ai-agent-security/skills/github/wcfcarolina13/X-Scraper-MCP/fxtwitter"><img src="https://mondoo.com/ai-agent-security/api/badge/github/wcfcarolina13/X-Scraper-MCP/fxtwitter.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/wcfcarolina13/X-Scraper-MCP/fxtwitter.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.