X (Twitter) Search by Desearch

• Analyzed: May 12, 2026, 4:17 AM
• Findings: 1
• Version: 1.0.1
• Hash: 9d964ec787f6ff44f7e909e96fd1d260abd46f71a426f203c14a2084f0c5b429
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a CLI client for the Desearch X (Twitter) API. The `SKILL.md` documentation is purely descriptive, outlining the skill's purpose, setup, and usage, without any prompt injection attempts or manipulative instructions for the AI agent. The `scripts/desearch.py` code correctly retrieves the `DESEARCH_API_KEY` from environment variables, makes network requests only to the legitimate `api.desearch.ai` endpoint, and uses standard Python libraries (`argparse`, `urllib`, `json`) to safely handle and encode user inputs, preventing command or shell injection. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or obfuscation. The code's behavior is entirely aligned with its stated purpose.