Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Desearch-powered X/Twitter search helper that uses a disclosed API key and external search API without evidence of hidden persistence, destructive behavior, or unrelated access.
Install this only if you are comfortable sending X/Twitter search terms, usernames, post URLs, IDs, filters, and your Desearch API key-authenticated requests to Desearch. Avoid submitting confidential investigations, secrets, or regulated data as search inputs unless Desearch's handling policies meet your needs.
The skill advertises use of an environment variable-backed API key and third-party network access, but does not declare an explicit tool scope such as permissions or allowed-tools. That weakens least-privilege controls and makes it harder for a host agent or reviewer to understand and restrict what the skill is allowed to access, increasing the chance of unintended secret or network use.
The skill clearly sends user-provided search terms, usernames, URLs, and other query parameters to a third-party service using an API key, but the description does not warn users that their inputs leave the local environment. This creates a privacy and consent risk, especially if users submit sensitive investigations, internal identifiers, or confidential targets assuming the search is local.
No suspicious patterns detected.
