xAI Search

• Analyzed: May 12, 2026, 3:07 AM
• Findings: 1
• Version: 1.0.4
• Hash: 356c03e3213780d3640b0c41d5f51ea1515877737c0faee1867d864812e94175
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed to interact with the xAI Grok API for web and X/Twitter search. The `SKILL.md` provides clear instructions and `curl` examples for using the xAI API, and the `scripts/xai-search.py` script implements this functionality using the official `xai-sdk`. The script correctly retrieves the `XAI_API_KEY` from environment variables and uses it to make legitimate API calls to `api.x.ai`. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, prompt injection attempts against the agent, or obfuscation. All actions are aligned with the stated purpose.