X Trends

PassAudited by ClawScan on May 1, 2026.

Overview

The skill appears to do what it claims: fetch public X trending-topic data from getdaytrends.com and print it, with only minor third-party network and package provenance notes.

This skill looks safe for its stated purpose. Before installing, be comfortable with it contacting getdaytrends.com and with the normal npm dependency chain used by the CLI.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Info

#ASI02: Tool Misuse and Exploitation

What this means

Running the command sends the selected country path to getdaytrends.com and returns public web content as trend results.

Why it was flagged

This shows the CLI performs an outbound request to getdaytrends.com based on the requested country. That is disclosed and purpose-aligned, but users should know the tool contacts a third-party site.

Skill content

const url = `https://getdaytrends.com/${countrySlug ? countrySlug + '/' : ''}`;
...
const html = await fetchTrends(url);

Recommendation

Use it for public trend lookups only, and treat returned trend names/links as untrusted public web data.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The main security dependency is trust in the packaged code and its npm dependencies, not any credential or local-data access by the skill itself.

Why it was flagged

The skill depends on third-party npm packages. This is normal for a Node CLI and a lockfile is included, but installation still relies on the npm dependency chain.

Skill content

"dependencies": {
  "chalk": "^5.3.0",
  "cheerio": "^1.0.0",
  "commander": "^12.0.0",
  "ora": "^8.0.0"
}

Recommendation

Install from the reviewed package version and keep the lockfile/dependencies under normal supply-chain review if using it in a sensitive environment.