Twitter Search

• Analyzed: May 12, 2026, 3:08 AM
• Findings: 1
• Version: 0.1.2
• Hash: 8126025c32fd59faee606192d1a4eea619828795873ea4a156c392ff5fbab65c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious primarily due to the use of `eval` in `scripts/run_search.sh`. This command is used to load the `TWITTER_API_KEY` from `~/.bashrc` or `~/.zshrc` by executing the output of a `grep` command. While the `grep` attempts to narrow the scope to a specific `export` line, `eval` is inherently a high-risk command that could be exploited if the user's shell configuration file were already compromised, potentially leading to arbitrary code execution. The skill also makes external network calls to `https://api.twitterapi.io` for its core functionality, which is expected for a Twitter search skill but involves transmitting an API key to a third-party service. No clear evidence of intentional malicious behavior (e.g., data exfiltration to unauthorized endpoints, persistence, or prompt injection) was found, but the `eval` usage represents a significant security risk.