Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed X/Twitter search helper that sends user search queries to xAI and does not show hidden persistence, destructive behavior, or unrelated data access.
Install this only if you are comfortable using xAI for X/Twitter search. Do not submit secrets, credentials, private project names, or sensitive personal data as search queries, because the query is sent to xAI. Consider tightening the trigger wording and adding an explicit privacy note before broad deployment.
The skill requires environment access for XAI_API_KEY and makes outbound network calls, but it does not declare an explicit tool scope such as permissions or allowed-tools. That weakens least-privilege controls and can allow the runtime to grant broader capabilities than users or orchestrators expect, especially for a skill that contacts an external API and handles secrets.
The description contains broad trigger phrases like 'find tweets', 'search X/Twitter', and 'look up what people are saying on X', which can match many ordinary user requests. Over-broad activation increases the chance this skill is invoked unintentionally, causing unexpected external network requests and exposure of user queries to a third-party service.
Line L03 says to use the skill when the user wants to "find tweets," "search X/Twitter," "look up what people are saying on X," or "find social media posts about a topic." These phrases are fairly broad and lack exclusion conditions or narrow activation constraints, which could cause the skill to be invoked for generic research requests rather than clearly scoped X-search tasks.
The skill instructs users to submit arbitrary search queries to the xAI API but does not clearly disclose that those queries are transmitted to an external third-party service. In practice, users may include sensitive research topics, internal project names, or personal data in searches, causing unintended off-system data exposure.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
def redirect_request(self, req, fp, code, msg, headers, newurl):
raise HTTPError(newurl, code, f"Redirect to {newurl} blocked (auth safety)", headers, fp)
API_URL = "https://api.x.ai/v1/responses"
MODEL = "grok-4.20-reasoning"
TIMEOUT_S = 120
MAX_HANDLES = 10
No suspicious patterns detected.