Search X

PassAudited by ClawScan on May 1, 2026.

Overview

Search X appears purpose-aligned: it runs a bundled Node script to send user-requested X/Twitter searches to xAI using your API key.

This skill is reasonable to install if you are comfortable using xAI for X/Twitter search. Use a dedicated API key if possible, avoid sensitive searches, confirm Node is available from a trusted source, and verify the package/repository because the registry metadata is not perfectly consistent.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill may not run unless Node is available, and users should verify they are running the intended bundled script.

Why it was flagged

The runtime instructions require Node, while the registry lists no required binaries and no install spec. This is a metadata completeness/provenance note rather than hidden execution because the script is included and no remote installer is shown.

Skill content

node {baseDir}/scripts/search.js "AI video editing"

Recommendation

Declare Node as a required runtime, keep registry/SKILL/package versions consistent, and install only from a trusted package or repository.

Low

#ASI03: Identity and Privilege Abuse

What this means

Searches can consume the user's xAI API quota and operate under the user's xAI account.

Why it was flagged

The script uses an xAI API key from the environment or local config, including a generic xai fallback key. This is expected for xAI search, but it is account credential use.

Skill content

if (process.env.XAI_API_KEY) { return process.env.XAI_API_KEY; } ... config?.skills?.entries?.['search-x']?.apiKey || config?.skills?.entries?.xai?.apiKey

Recommendation

Use a dedicated, revocable xAI API key where possible and monitor usage in the xAI console.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Search terms, handles, date filters, and related request metadata are shared with xAI.

Why it was flagged

The script sends the user's query and authorization token to xAI's Responses API. This external provider call is disclosed and central to the skill's purpose, but it is still a data boundary users should notice.

Skill content

const API_BASE = 'api.x.ai'; ... path: '/v1/responses' ... input: `${systemPrompt}\n\nSearch X/Twitter for: ${options.query}` ... 'Authorization': `Bearer ${apiKey}`

Recommendation

Avoid searching for confidential or sensitive internal topics unless sharing them with xAI is acceptable under your policies.