Last 30 Days (Lite)

• Outcome: Review
• Latest audit: May 27, 2026 at 9:12 PM UTC
• Version:
  1.0.0

Overview

This is a coherent recent-research skill, but it may use a local X/Twitter cookie-backed session through bird without enough user control or scoping.

Install only if you are comfortable with recent-topic searches being sent to Brave/web search, Reddit, and possibly X/Twitter through your configured bird session. Check which X/Twitter account or cookies bird uses, avoid confidential topics, and prefer explicit /last30days invocation or disable the bird step if you do not want authenticated X/Twitter searches.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The activation condition is broad enough that the skill may trigger on ordinary requests for recent information, causing it to run external searches when the user did not explicitly intend to invoke this tool. In this skill, that increases privacy and consent risk because execution may query Reddit, the web, and X/Twitter using configured capabilities, including authenticated X/Twitter access via bird.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that bird uses preconfigured X/Twitter cookies but does not warn the user that searches may be performed with authenticated session credentials. This is dangerous because users may unknowingly cause actions tied to an account context, exposing metadata, account association, or violating user expectations about anonymous/public-only searching.

VirusTotal

64/64 vendors flagged this skill as clean.