Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward product-description generator that sends user-provided product text to the x.ai API with a user-supplied API key.
Install only if you are comfortable sending product names, features, and prompts to x.ai under your API key. Avoid using unreleased, confidential, regulated, or customer-sensitive product data unless your organization permits that sharing.
The skill requires an API key and makes outbound network calls, but it does not declare any explicit tool scope such as permissions or allowed-tools. That weakens reviewability and consent because a host agent or user cannot easily see, at the policy layer, that the skill can access secrets and transmit data externally.
The skill describes generating product descriptions from product names and features, but it does not clearly warn that this input will be sent to an external AI provider. Users may unknowingly submit proprietary product plans, embargoed launches, or sensitive business information to a third party, creating confidentiality and compliance risk.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Requires: XAI_API_KEY environment variable
set -euo pipefail
API_URL="https://api.x.ai/v1/chat/completions"
_check_key() {
if [[ -z "${XAI_API_KEY:-}" ]]; then
No suspicious patterns detected.