Twikit MCP Server

Untrusted-input tools ([get_tweet, get_tweet_replies, download_tweet_video, get_timeline, get_user_tweets, get_bookmarks, get_favoriters, get_retweeters, search_user, get_trends, get_article, get_lists, get_list_tweets, get_list_members, get_list_subscribers, get_communities_timeline, get_community_members, get_community_moderators, xchat_list_conversations, xchat_get_history]) co-exist with external-action tools ([send_tweet, download_tweet_video, like_tweet, retweet, delete_tweet, unfavorite_tweet, delete_retweet, bookmark_tweet, delete_bookmark, create_scheduled_tweet, delete_scheduled_tweet]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.

Evidence: untrusted [get_tweet, get_tweet_replies, download_tweet_video, get_timeline, get_user_tweets, get_bookmarks, get_favoriters, get_retweeters, search_user, get_tr

Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.

Location: flow get_tweet → send_tweet

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_cli.py:184`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: uring IO.""" return subprocess.run( [sys.executable, "-m", "twitter_mcp.server", *args], capture_out

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_cli.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_docs_api_listing.py:37`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ess import sys subprocess.run( [sys.executable, str(_REPO_ROOT / "scripts" / "gen_api_docs.py")],

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_docs_api_listing.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_docs_cli_listing.py:47`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: i_docs.py" result = subprocess.run( [sys.executable, str(script)], capture_output=True, text

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_docs_cli_listing.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_pr_review_workflow.py:105`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: alse", ) proc = subprocess.run( ["bash", "-e", "-c", _extract_run_block("call")], cwd=tmp_path,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_pr_review_workflow.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_server.py:865`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } ) result = subprocess.run( [sys.executable, "-m", "twitter_mcp.server"], input=init_request

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_server.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_vendor.py:409`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } ) result = subprocess.run( [sys.executable, "-m", "twitter_mcp.server"], input=init_request

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_vendor.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_video_download.py:224`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: """FileNotFoundError on exec (yt-dlp not on PATH) → ToolError with hint.""" async def explode(*cmd, **kwargs):

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_video_download.py