Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed X prospecting helper that uses Brave Search and local scoring/content generation, with no evidence of hidden posting, persistence, or data theft.
Install this only if you are comfortable providing a Brave Search API key and sending your X search keywords to Brave. Review generated outreach before using it and ensure it complies with X rules, privacy expectations, and anti-spam requirements.
The manifest describes the skill primarily as searching X via Brave, but the documented commands also perform prospect scoring, thread generation, and multi-step DM outreach. This mismatch can mislead reviewers and users about the true operational scope, causing them to grant trust or permissions under incomplete assumptions and enabling broader data handling or automated persuasion workflows than expected.
The skill requires an environment secret (BRAVE_API_KEY) but does not declare an explicit tool scope such as permissions or allowed-tools. That weakens transparency and enforcement around what the skill is allowed to access, increasing the risk of secret use outside clearly declared boundaries if the runtime relies on manifest scoping.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s -H "Accept: application/json" \
-H "X-Subscription-Token: $BRAVE_API_KEY" \
"https://api.search.brave.com/res/v1/web/search?q=site:x.com+%22looking+for+AI+tools%22&count=10"
Substitute the query with your target keywords. Parse results to extract handles and tweet text, then run through lead scoring.
This code performs an outbound HTTPS request using the supplied search keyword to a third-party service. Although the file header mentions use of Brave Search, there is no user-facing disclosure in the CLI flow or at the call site that the entered keyword will be sent externally.
No suspicious patterns detected.