Last30 Deep Research

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:01 AM UTC
• Version: 1.1.1

Overview

The skill is a legitimate multi-source research helper, but it uses sensitive X session cookies and auto-saves research reports in ways users should review before installing.

Install only if you are comfortable sending research topics to the listed external services and saving reports under ~/Documents/Last30Days. Avoid using this for confidential topics, and be cautious enabling X search because it requires session cookies that the script passes to a local command.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/research.py:151

Finding

X Session Credentials Exposed Through Process Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/research.py, lines 21–22 and 151–156
Vulnerability Type: Sensitive credentials exposed through command-line arguments
Risk Level: Medium

Vulnerable Code:

python

AUTH_TOKEN = os.environ.get("AUTH_TOKEN", "")
CT0 = os.environ.get("CT0", "")

python

cmd = [
    "bird", "search", f"{topic}", "-n", str(limit),
    "--auth-token", AUTH_TOKEN,
    "--ct0", CT0,
    "--plain"
]

Technical Analysis

The Skill reads the X authentication cookies AUTH_TOKEN and CT0 from environment variables, then embeds their values directly into the argument vector used to launch the bird subprocess.

Although subprocess.run() is invoked without a shell and therefore does not create a command-injection issue here, placing secrets in process arguments creates a separate credential-disclosure risk. Depending on the host operating system, process isolation, and observability configuration, command arguments may be exposed through process inspection interfaces, privileged monitoring agents, audit records, diagnostic tooling, exception reports, or application telemetry.

These values represent authenticated X session credentials rather than low-sensitivity configuration. Their disclosure may allow an attacker to impersonate the affected user within the permissions and lifetime of that session.

The use of X credentials is relevant to the declared X search functionality, but exposing them through process arguments exceeds the minimum disclosure necessary to perform that function.

Attack Path

1. A user configures valid AUTH_TOKEN and CT0 environment variables to enable X search.
2. The Skill invokes bird search and places both credential values in its subprocess arguments.
3. A local user, privileged process monitor, audit collector, or diagnostic service observes or records the child process command line while it executes.
4. The observer ...[truncated 903 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not place authentication tokens, cookies, API keys, or other secrets in subprocess command-line arguments.
2. Use a credential-input mechanism supported by bird, such as protected standard input, a dedicated inherited file descriptor, or integration with an operating-system credential store.
3. If bird only supports environment-based authentication, pass a minimal child-specific environment and document that environment variables may still be observable by sufficiently privileged local processes.
4. If a configuration file is unavoidable, create it with owner-only permissions, avoid shared temporary directories, pass only its path to the subprocess, and securely remove it immediately after execution.
5. Ensure command arguments and environments are excluded from telemetry, debug logs, crash reports, and audit output where operationally possible.
6. Minimize session scope and lifetime, rotate potentially exposed cookies, and advise users to revoke X sessions if process arguments may have been captured.
7. Prefer delegated, narrowly scoped authentication over reusable browser session cookies when the external service and client support it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill’s declared behavior does not fully match what it does: it writes reports to disk without clearly declaring that up front, overstates enforcement of a 30-day recency boundary, and presents lightweight aggregation as deeper synthesis. This is dangerous because users and calling agents may trust the output or permit execution based on incomplete disclosure, leading to privacy, integrity, and decision-making risks.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares capabilities that imply access to environment variables, shell execution, networking, and local file writes, but it does not define any explicit tool scope or permission boundaries. In an agent environment, that omission can allow the skill to run with broader privileges than users expect, increasing the blast radius if the skill is invoked on sensitive topics or with untrusted input.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Broad trigger phrases like 'research [topic]' or 'what's trending in [topic]' can cause the skill to activate outside a clearly intentional command context. Because the skill performs network access and local file writes, accidental invocation can lead to unintended external queries, data handling, and persistent local artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill states that every run auto-saves a markdown report locally, but this persistence behavior is not prominently disclosed before use. That creates a privacy and data-governance risk because user queries and synthesized results may be written to disk without informed consent or awareness.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The stated purpose is cross-source research over recent content, which justifies network access to those sources, but not arbitrary process execution. Using a local CLI introduces an execution capability that goes beyond the manifest's described research behavior and expands the trust boundary to whatever binary is present on the host.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/research.py (reported line 58)May include surrounding context.

python

def run_cmd(cmd: list[str], timeout: int = 30) -> str:
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
        return result.stdout + result.stderr
    except Exception as e:
        return f"[ERROR: {e}]"

Tainted flow: 'cmd' from os.environ.get (line 150, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/research.py (reported line 58)May include surrounding context.

python

def run_cmd(cmd: list[str], timeout: int = 30) -> str:
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
        return result.stdout + result.stderr
    except Exception as e:
        return f"[ERROR: {e}]"

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill writes a report containing user prompts and aggregated external content to a local filesystem path by default, even though its stated purpose is just to research and synthesize. In agent environments, silent persistence can leak sensitive research topics, create unintended data retention, and expose contents to other local users or tools.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

This code transmits the user topic to Brave's API for YouTube discovery, which is an external data disclosure channel. The risk is contextual rather than exploit-driven: if users research sensitive matters, those queries leave the local environment and are exposed to a third party.

Content

Scanner excerpt · scripts/research.py (reported line 219)May include surrounding context.

python

limit = {"quick": 5, "balanced": 10, "deep": 20}.get(mode, 10)
    query = f"{topic} site:youtube.com"
    
    url = "https://api.search.brave.com/res/v1/web/search"
    headers = {
        "Accept": "application/json",
        "X-Subscription-Token": BRAVE_API_KEY,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

This web search request sends raw user-provided topics to Brave's external service. In a research skill, this behavior is functionally expected, but without clear notice and controls it still creates a privacy and data-handling vulnerability for sensitive queries.

Content

Scanner excerpt · scripts/research.py (reported line 256)May include surrounding context.

python

limit = {"quick": 10, "balanced": 25, "deep": 40}.get(mode, 25)
    query_enc = urllib.parse.quote(topic)
    url = f"https://api.search.brave.com/res/v1/web/search?q={query_enc}&count={limit}"
    
    req = urllib.request.Request(url)
    req.add_header("Accept", "application/json")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script sends the user-supplied research topic to multiple third-party services (Reddit, HN, Brave, Polymarket, and potentially X) without any explicit consent, warning, or minimization. In an agent context, users may submit confidential project names, incident details, or internal codenames, causing unintended external disclosure across several providers.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The attribution note says this port uses public APIs for a 'lightweight, zero-API-key setup', but elsewhere the same file explicitly requires BRAVE_API_KEY for web search. This is a direct contradiction in the documentation about required capabilities and setup.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The top-level documentation enumerates supported sources and omits Polymarket, while the implementation includes a full search_polymarket path and surfaces those results in the final report. This is an active documentation/code mismatch about the skill's actual coverage.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.