X (Twitter) Search by Desearch

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears to be a read-only X/Twitter search helper that uses a Desearch API key and sends search requests to Desearch as advertised.

This looks appropriate for searching X/Twitter through Desearch. Before installing, make sure you trust Desearch with your search queries and API key, and use a dedicated key you can revoke.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Your Desearch API key will be used whenever the skill makes searches, so usage may be tied to your Desearch account and quota.

Why it was flagged

The script reads a Desearch API key from the environment and sends it as the Authorization header for API requests.

Skill content
key = os.environ.get("DESEARCH_API_KEY") ... "Authorization": f"{api_key}"
Recommendation

Use a dedicated Desearch API key, keep it private, and rotate or revoke it if you no longer use the skill.

What this means

Search terms and requested X/Twitter targets are shared with Desearch to perform the lookup.

Why it was flagged

Search queries, usernames, post IDs, URLs, and filters are sent to Desearch's external API, which is necessary for the advertised service.

Skill content
DESEARCH_BASE = "https://api.desearch.ai" ... req = Request(url, data=data, headers=headers, method=method)
Recommendation

Avoid sending sensitive search terms unless you are comfortable with Desearch processing them, and review the provider's privacy terms if needed.