Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward API guide for querying Macrocosmos social-media data, with expected use of a Macrocosmos API key and outbound requests.
Install only if you are comfortable sending search terms, usernames, date filters, and your MC_API credential to Macrocosmos. Avoid using confidential, regulated, or sensitive investigative queries unless your organization approves that data sharing.
The skill instructs agents to send user-supplied search terms and an API credential to a third-party service, but it does not warn that prompts, usernames, keywords, and timing metadata leave the local environment. That omission can cause unintentional disclosure of sensitive investigative queries or secrets-adjacent metadata when users assume the skill is purely local.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
---
## curl Examples
### 1. Keyword Search on X
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"limit": 10
}
response = requests.post(url, json=payload, headers=headers)
data = response.json()
for tweet in data["data"]:
No suspicious patterns detected.