X / Twitter Search

ReviewAudited by ClawScan on May 10, 2026.

Overview

Prompt-injection indicators were detected in the submitted artifacts (system-prompt-override); human review is required before treating this skill as clean.

Before installing, confirm you trust the source, review scripts/search.js, and use provider API keys you are comfortable granting for search and billing/quota usage. Avoid putting sensitive private information in search queries because they are sent to xAI or X. ClawScan detected prompt-injection indicators (system-prompt-override), so this skill requires review even though the model response was benign.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

Your search terms are sent to xAI or X, and X API mode may incur provider usage charges.

Why it was flagged

The skill performs network API calls as its core function. This is purpose-aligned and disclosed, but users should understand that searches are sent to external providers.

Skill content

Calls xAI's `/v1/responses` endpoint (Grok mode) or X's `/2/tweets/search/recent` endpoint (X API mode)

Recommendation

Use the skill only for queries you are comfortable sending to those providers, and verify command flags such as --x-api, --days, and --max before running.

Note

ASI03: Identity and Privilege Abuse

What this means

The API key or bearer token can consume your provider quota or billing allowance if misused outside this skill.

Why it was flagged

The script uses bearer credentials to authenticate to the provider API. This is expected for the integration and the visible code sends them only to the disclosed API hosts.

Skill content

headers: { 'Authorization': `Bearer ${apiKey}`, }

Recommendation

Use least-privilege provider credentials where available, store them securely, and revoke or rotate them if you no longer use the skill.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

It may be harder to confirm that the installed code matches a trusted upstream source.

Why it was flagged

The registry metadata does not identify a verified source repository, which limits provenance assurance even though the visible package is small and dependency-free.

Skill content

Source: unknown

Recommendation

Review the installed scripts/search.js before first use and install only from a trusted ClawHub entry or repository.