Security audit
Security checks for vulnerabilities and agentic risk
SCRY is a real multi-source research skill, but its default X/Twitter path can try to read browser session cookies without a clear per-run opt-in.
Review this carefully before installing. The public-source research behavior is mostly coherent, but do not run the default source set on a machine with browser X/Twitter sessions unless you are comfortable with the skill attempting to use those session cookies. Prefer restricting sources, using tier-1/public sources, or providing a narrowly scoped API key instead of browser cookies.
vendor/bird-search/lib/cookies.js:39Automatic Extraction and Use of Browser Session Cookies Without Explicit Opt-In
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
mkdir -p ~/.config/scry echo 'XAI_API_KEY=xai-...' > ~/.config/scry/.env chmod 600 ~/.config/scry/.env
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
mkdir -p ~/.config/scry echo 'XAI_API_KEY=xai-...' > ~/.config/scry/.env chmod 600 ~/.config/scry/.env
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
mkdir -p ~/.config/scry echo 'XAI_API_KEY=xai-...' > ~/.config/scry/.env chmod 600 ~/.config/scry/.env
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
mkdir -p ~/.config/scry echo 'XAI_API_KEY=xai-...' > ~/.config/scry/.env chmod 600 ~/.config/scry/.env
The declared description says the skill's purpose is to research topics across many sources. This code chunk does not itself implement multi-source research functionality; instead, it orchestrates and benchmarks two other tools by invoking them as subprocesses, parsing their JSON, comparing outputs, and reporting metrics and a winner. That is a materially different primary purpose: evaluation of research tools rather than direct topic research. The file-reading batch mode and dependency on an external script in another skill path are also undeclared capabilities/resources relative to the description.
The declared description promises a comprehensive research capability across many named external platforms. However, the supplied code chunk is only an empty Python package initializer with a comment and contains no functional logic. Because the actual code does not implement the described behavior or any visible subset of it, the description is not accurately represented by this code chunk.
The description promises extensive cross-source research capability, but the supplied code chunk does not demonstrate any such behavior. It is only an empty module initializer comment ('SCRY source modules') with no logic, integrations, triggers, or resource access. This is a material description-versus-code mismatch because the declared primary purpose is not represented by the actual code shown.
The declared description presents a comprehensive, general-topic research skill spanning many named sources. The supplied code chunk does something materially narrower: it defines only a CoinGecko source module, available in the crypto/finance domain, and queries CoinGecko's API for coin search and detail data. While this may be one component of a larger multi-source research system, this specific code chunk does not itself match the broad declared purpose. Its primary behavior is cryptocurrency asset lookup and enrichment, not research across 26+ diverse sources.
The declared description presents a comprehensive, multi-source general research capability across many named platforms. The supplied code chunk, however, is narrowly scoped to one source: SEC EDGAR. It queries the SEC search index for specific filing types, parses filing metadata, and constructs SEC archive URLs. That is materially narrower than the declared purpose and uses a finance-specific source not disclosed in the description. While this may be one component of a larger research skill, evaluating this chunk on its own shows a description-behavior mismatch.
The description emphasizes a broad research skill spanning 26+ named sources, but this code chunk only implements TikTok search via the ScrapeCreators API. TikTok is not mentioned in the declared description, so this is an undeclared source capability. Additionally, the code depends on an external API key (SCRAPECREATORS_API_KEY), while the declared permissions list is empty, indicating inconsistent resource access. While this may be one component of a larger research system, evaluated in isolation the code's behavior is narrower and includes an undeclared platform integration.
The declared description says this skill performs broad multi-source research across many platforms. The supplied code does not implement research functionality at all. Instead, it is a credential-resolution module specifically for Twitter/X that reads auth_token and ct0 cookies from Safari, Chrome, Firefox, environment variables, or CLI arguments, and assembles them into a cookie header. This is a materially different purpose and introduces a sensitive undeclared capability: extracting local browser authentication cookies. That behavior is not a mere supporting detail of research; it is security-sensitive access to credentials and is inconsistent with the description and declared permissions.
The declared description presents a full-featured research/search capability across many named platforms. The supplied code chunk does not perform research, querying, source integration, or aggregation. It is an internal helper for paginating through cursor-based results using injected callbacks (fetchPage, sleep, getKey), deduplicating items, and handling continuation state. While such a helper could support a research tool, this chunk by itself materially differs from the declared primary purpose and lacks the claimed capabilities.
The declared description says this skill researches topics across many online sources. The supplied code does not perform any research, network access, source querying, aggregation, or content retrieval. Instead, it is a local runtime feature configuration module that manages feature overrides from bundled JSON, disk cache, and environment variables. These are materially different capabilities and represent a different primary purpose, so this is a clear description-behavior mismatch.
The supplied code does not perform research across multiple sources or retrieve topic information. Its sole purpose is X/Twitter-specific runtime discovery of query IDs from x.com pages and client bundles, with local disk caching and TTL handling. This is materially different from the declared purpose of comprehensive multi-source research. While X is mentioned in the description, the code only supports internal API/query ID discovery for X and does not implement any actual research workflow or access the other listed platforms.
The description presents a general-purpose multi-source research skill spanning many platforms, but this code chunk is narrowly focused on X/Twitter infrastructure. It manages authenticated Twitter session state, builds Twitter-specific headers, refreshes Twitter query IDs, and prepares requests to Twitter endpoints. Nothing in this chunk indicates cross-source research across 26+ platforms. This is a materially different primary purpose and includes undeclared capability for authenticated X/Twitter access.
The declared description promises a broad research tool spanning many external sources. The supplied code does something materially different: it exports functions that assemble feature flags for Twitter/X client operations such as article viewing, search, timelines, bookmarks, likes, lists, tweet details, tweet creation, and explore. There is no evidence of source aggregation, crawling, querying, or research orchestration across multiple platforms. While X is one of the declared sources, this code is not even performing research on X; it is only configuring client features for X-related endpoints/UI behavior. That is a clear description-behavior mismatch.
The declared description presents the skill as a broad, multi-source research tool spanning 26+ platforms. The supplied code chunk, however, is narrowly focused on Twitter/X search functionality. It constructs Twitter search requests, posts to the SearchTimeline endpoint, parses tweet results, handles pagination and cursor extraction, and refreshes query IDs on certain API/schema failures. There is no indication in this chunk of cross-source research, aggregation, or access to the many non-Twitter sources named in the description. This is a material description-to-behavior mismatch in scope and primary capability, not just an implementation detail.
The declared description promises a broad multi-source research capability. However, the supplied code chunk contains no executable logic beyond an empty export, so it does not demonstrate any of the claimed behavior. This is a material mismatch in primary purpose and implemented capabilities.
The declared description promises a broad research capability spanning many platforms and sources. The supplied code chunk does not implement cross-source research or search orchestration. Instead, it is narrowly scoped to X/Twitter response handling: extracting tweet/article text, note tweets, media, metadata, users, cursors, and rendering Twitter article Draft.js content. While X is one of the declared sources, this code only supports that single source and functions as a parsing/normalization helper rather than a comprehensive multi-source research tool. That is a material description-behavior mismatch for this chunk.
This file explicitly reads environment variables and local config files, so it has credential and host-environment access beyond pure remote research logic. In a research skill, that capability is security-relevant and should be declared and tightly scoped because it can expose secrets or local system state to other parts of the skill.
Opening ~/.config/scry/.env causes the skill to ingest local credential material from disk. In an agent skill that processes external content, local secret harvesting is dangerous because any later prompt injection, logging bug, or network transmission path could expose those credentials.
# Load from config file first (lower priority)
for config_path in [
os.path.expanduser("~/.config/scry/.env"),
os.path.expanduser("~/.config/last30days/.env"), # Compatibility
]:
if os.path.isfile(config_path):
Reading ~/.config/last30days/.env expands access to a second, compatibility-related secret store that is not obviously necessary for this skill's core function. This broadens credential exposure across applications and increases the blast radius if the skill is compromised or tricked into revealing what it loaded.
# Load from config file first (lower priority)
for config_path in [
os.path.expanduser("~/.config/scry/.env"),
os.path.expanduser("~/.config/last30days/.env"), # Compatibility
]:
if os.path.isfile(config_path):
with open(config_path) as f:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
config[key] = val
# Check for config file
config_file = os.path.expanduser("~/.config/scry/.env")
if os.path.isfile(config_file):
with open(config_file) as f:
for line in f:
The code copies the entire parent process environment and passes it to a vendored external Node subprocess. This can unnecessarily expose unrelated secrets, tokens, and configuration values to third-party code in vendor/bird-search.mjs, increasing the blast radius if that script is compromised or logs/exfiltrates env data.
def _build_bird_env(self, config):
"""Build env dict for Bird subprocess with credentials."""
env = os.environ.copy()
if config.get("AUTH_TOKEN"):
env["AUTH_TOKEN"] = config["AUTH_TOKEN"]
if config.get("CT0"):
This code reads X/Twitter authentication material from environment variables and is part of a credential-resolution path for the skill. In the context of a general research skill, collecting auth_token and ct0 values is sensitive capability expansion that can expose account session credentials and enable authenticated actions or data access beyond what a user would reasonably expect.