twitter-scraper
Pass
Audited by Gen Agent Trust Hub on Apr 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's primary functionality is to automate the scraping of public social media data through xcancel.com (a known Nitter instance). It uses the platform's native browser tool for data acquisition and does not require credentials or private access.
- [PROMPT_INJECTION]: Analysis identified a surface for indirect prompt injection, as the skill processes untrusted content from external tweets.
- Ingestion points: The
parse_tweets_from_htmlfunction inscripts/scraper.pyprocesses raw HTML from the browser. - Boundary markers: No specific delimiters or instructions to ignore embedded commands are present in the processing logic.
- Capability inventory: The skill is limited to content extraction and formatting; it does not perform subprocess execution or file-system writes based on the scraped content.
- Sanitization: The script implements
_clean_htmlwhich strips HTML tags and decodes entities, though this is intended for data cleaning rather than security sandboxing.
Audit Metadata