Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says: it searches X/Twitter through xAI using the user's API key, with no hidden persistence or unrelated local access found.
Install this only if you are comfortable sending your X/Twitter search queries and API key-authenticated requests to xAI. Avoid putting secrets, private project details, or sensitive personal data in search queries, and consider tightening the trigger wording if you publish or operate this skill for others.
The skill requires environment access for XAI_API_KEY and performs networked API calls, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization and review gap: a host may invoke the skill without clear least-privilege boundaries, making secret access and outbound network use less transparent and harder to constrain.
The invocation guidance says to use the skill when the user wants to "look up what people are saying on X" or "find social media posts about a topic," which are broad natural-language cues that could match many everyday requests. The description does not provide narrower trigger constraints or negative examples to clarify when this skill should and should not activate.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
def redirect_request(self, req, fp, code, msg, headers, newurl):
raise HTTPError(newurl, code, f"Redirect to {newurl} blocked (auth safety)", headers, fp)
API_URL = "https://api.x.ai/v1/responses"
MODEL = "grok-4.20-reasoning"
TIMEOUT_S = 120
MAX_HANDLES = 10
The script sends the user's raw search query to the external xAI API, but the code provides no user-facing disclosure, consent prompt, or minimization step before transmission. In a search skill, users may include sensitive names, credentials, internal project details, or other confidential text, which would then leave the local trust boundary and be processed by a third party.
No suspicious patterns detected.