twitter Audit report.

Warnings

• Dependency or permission surface needs review
• Permission surface may require sandboxing
• SKILL.md instructs users to export API key in ~/.zshrc, which is a shell-specific configuration and may not be portable across environments (e.g., Windows, CI).
• The skill does not explicitly warn against using it with untrusted input or mention rate limits/error handling for API failures.
• The plugin.json declares MIT license while the repository is Apache-2.0; this inconsistency could cause confusion.
• No explicit documentation on data retention or compliance with Twitter's terms of service for the API.
• Quality score needs review
• Permission surface needs review: secrets or environment access, shell or command execution
• Dependency/runtime risk: command execution surface, credential or environment access
• Permission surface: secrets or environment access, shell or command execution

Method

This report combines public metadata, AI review output, repository freshness, install readiness, OpenAgentSkill events, quality scoring, trust checks, and the agent safety gate. It is not a full source-code security review.