X Hourly Brief

• Analyzed: May 11, 2026, 5:27 AM
• Findings: 1
• Version: 1.0.0
• Hash: e49792a04613870b2f9ea6dbeed0d8688fcf5e4bd687691f6e54be7baee4a180
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill implements a mandatory 'charge-first' billing mechanism that blocks execution unless a successful API call is made to an external service (skillpay.me), as seen in scripts/run.js. It transmits a user_id to this third-party endpoint and directs users to external payment URLs. While the script performs its stated function of fetching X posts via proxies like r.jina.ai and fxtwitter.com, the hardcoded API key and the requirement for external financial transactions for a 'Premium' service with very primitive summarization logic warrant caution.