X Followings Digest

• Analyzed: May 12, 2026, 3:18 AM
• Findings: 1
• Version: 1.1.1
• Hash: 7f5941dfcb3215b45a03eadd444e95328eef161edde50a415e20b714913bcbd4
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as benign. Its purpose is to fetch tweets using X/Twitter authentication tokens (`AUTH_TOKEN`, `CT0`) and generate an AI-powered digest. The `fetch_followings_tweets.sh` script correctly checks for these environment variables and passes them to the `bird` CLI tool, which is a prerequisite. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the agent in `SKILL.md` or `analyst_prompt_template.md`. The use of sensitive credentials is inherent to the skill's stated purpose and handled in a standard, non-malicious manner.