X Trends Dev

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: x-trends-dev Version: 1.0.0 The skill bundle is classified as benign. The `index.js` script correctly implements the stated purpose of fetching X (Twitter) trends by making HTTPS GET requests to `getdaytrends.com` and parsing the HTML using `cheerio`. There is no evidence of data exfiltration, malicious execution, persistence, or obfuscation. The `SKILL.md` file contains standard usage instructions and descriptions, with no attempts at prompt injection against the AI agent. All dependencies listed in `package.json` and `package-lock.json` are legitimate and widely used libraries for CLI tools and web scraping.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

Using the skill sends the selected country/path request to getdaytrends.com and returns public trend text from that site.

Why it was flagged

The tool contacts a fixed public website to fetch trend data. This is disclosed and purpose-aligned, but it is still a third-party network call users should be aware of.

Skill content

const url = `https://getdaytrends.com/${countrySlug ? countrySlug + '/' : ''}`;
...
const html = await fetchTrends(url);

Recommendation

Use it for public trend lookup, and treat returned trend names and links as external public data rather than trusted instructions.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

You can review the included code, but you have less external assurance about where the package came from or how future installs are reproduced.

Why it was flagged

The included code is simple and coherent, but the registry does not provide an independent source/homepage or a clear install specification, leaving limited provenance for the packaged CLI.

Skill content

Source: unknown
Homepage: none
Install specifications: No install spec — this is an instruction-only skill.

Recommendation

Install only if you trust the registry owner/package, and prefer future releases with a source repository, consistent version metadata, and a reproducible install path.