Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward X/Twitter search helper that uses the xAI API as disclosed, with no hidden persistence, destructive behavior, or unrelated data access found.
Install this only if you are comfortable sending search terms and filters to xAI using your XAI_API_KEY. Avoid searching for confidential or regulated information unless your xAI account and policies permit that use.
The skill declares executable/network-capable behavior and use of environment secrets, but does not specify an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and can cause the host agent to grant broader execution or network access than users expect, especially since the skill calls an external API with an API key.
The description uses broad trigger phrases like 'find tweets,' 'search X/Twitter,' and 'look up what people are saying,' which are common conversational intents that may cause the skill to be invoked more often than a narrowly scoped skill. Over-broad invocation can unexpectedly send user queries to an external service and consume credentials or expose user content without sufficiently clear intent.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
def redirect_request(self, req, fp, code, msg, headers, newurl):
raise HTTPError(newurl, code, f"Redirect to {newurl} blocked (auth safety)", headers, fp)
API_URL = "https://api.x.ai/v1/responses"
MODEL = "grok-4.20-reasoning"
TIMEOUT_S = 120
MAX_HANDLES = 10
This code packages the user's query into a JSON request body and sends it to an external service at api.x.ai, but there is no confirmation prompt, print/log notice, or explanatory comment warning that user-provided content will be transmitted off-host. For a code file, outbound HTTP transmission of user data should have some visible disclosure unless the warning exists elsewhere in markdown, which is not present in this file.
The setup and usage examples describe sending search queries to the xAI API for X search, but they do not clearly warn users that prompts, handles, date ranges, and possibly media-related query context are transmitted to an external provider. This can create a transparency and privacy issue when users assume the request is handled locally or are unaware of third-party data sharing.
The script reads a sensitive environment variable containing API credentials, but the file does not include a warning, explanatory comment, or other user-facing disclosure about credential usage. This matches the code-file criterion for sensitive environment variable access without visible disclosure in the reviewed file.
No suspicious patterns detected.