Scry

• Outcome: Review
• Latest audit: May 29, 2026 · 9:24 PM UTC
• Version: 0.1.0

Overview

This research skill is broadly aligned with its purpose, but it needs review because it can automatically use sensitive X/Twitter browser session cookies and broad local API-key configuration.

Review before installing. Use this only if you are comfortable with a research skill reading local provider tokens and, for X/Twitter, potentially using browser session cookies. Prefer scoped API keys over AUTH_TOKEN/CT0, avoid storing session cookies in .env files, restrict sources with --sources when researching sensitive topics, and periodically clear ~/.cache/scry and ~/.config/bird if you do not want retained local research or X client cache data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The benchmark script executes another local skill from ~/.claude/skills/last30days/scripts/last30days.py, which extends behavior beyond analyzing only the current skill and causes code from an unrelated local package to run. In a skill ecosystem, that means a user invoking this benchmark may unintentionally execute unreviewed or compromised code from another installed skill, creating a trust-boundary violation and unexpected side effects.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The configuration builder aggregates a wide set of credentials from both process environment variables and a user-local ~/.config/scry/.env file, including tokens not clearly required for this registry layer. Centralizing broad secret collection increases the blast radius if any downstream source module, logging path, error path, or prompt exposure leaks the config object. In a research aggregation skill that touches many external sources, this makes accidental credential overexposure more dangerous.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This code explicitly reads Twitter/X authentication material from environment variables and later combines it into a reusable cookie header. In a generic research skill, harvesting or consuming account session credentials is highly sensitive behavior because those tokens can enable authenticated account access, impersonation, and data access beyond what a user would expect from a search capability.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The function extracts auth_token and ct0 directly from Safari, Chrome, and Firefox local browser cookie stores, then assembles them into a valid Cookie header for authenticated requests. Browser cookie extraction is credential theft behavior unless narrowly justified and consented to, and here it is especially dangerous because the skill is presented as a broad research tool rather than a browser-session migration or forensic utility.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The file exposes write-capable Twitter/X endpoints for media upload, metadata creation, and status updates even though the skill is described as research-only. In this context, bundling posting endpoints expands the capability surface from passive data retrieval to account actions, creating a realistic risk of unauthorized posting or misuse if other code paths invoke them.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The fallback GraphQL query IDs include numerous mutation-style operations such as CreateTweet, CreateRetweet, follow/unfollow, like/unlike, and bookmark actions that are inconsistent with a research skill's stated purpose. This means the packaged dependency is not limited to read-only research and could enable account-modifying behavior if wired up elsewhere, undermining least privilege.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: These constants specifically enumerate account-action operations—tweet creation, retweets, follows, likes, and bookmarks—which are unjustified for a topic research tool. Because the skill context is explicitly passive research across sources, the presence of social-action capabilities makes the mismatch more dangerous by suggesting unnecessary latent powers over a user's X account.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README instructs users to enable X/Twitter access using browser cookies or tokens, which are highly sensitive session credentials. Even though this is presented as optional setup, the documentation does not warn that these values can grant account access, may violate platform expectations, and should never be casually copied, shared, or committed.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README provides a ready-to-copy `.env` file containing multiple API keys and auth tokens but does not include sufficient guidance on secret handling risks. This can normalize unsafe local secret storage practices, increase the chance of accidental disclosure through backups or commits, and expose long-lived credentials if the host is compromised.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This script launches local research scripts without any explicit user-facing notice that additional programs will be executed and may perform network access or other side effects. In the context of an agent skill, hidden subprocess execution is more dangerous because users may reasonably expect a benchmark to be read-only or self-contained, not to trigger other installed tools.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code accesses AUTH_TOKEN and CT0 session cookies and forwards them to a child process, enabling use of the user's authenticated X session outside the main process boundary. Even though this may be intended for functionality, passing browser/session credentials to a vendored tool increases the blast radius if that tool is compromised, logs env vars, or behaves unexpectedly.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill sends the user's research topic and date-bounded query to the external xAI API, which is a data egress path to a third party. In a research skill this may be expected, but without explicit disclosure and consent at the call site or product level, sensitive user queries could be transmitted off-platform unexpectedly.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script caches complete research results to local storage automatically whenever mock mode is not enabled, with no consent prompt, disclosure, or controls visible in this file. Because the queried topic may contain sensitive user interests or proprietary research subjects, this creates a privacy and data-retention risk if other local users, processes, or later runs can access the cache.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The file accesses sensitive authentication values without any visible user-facing consent, notice, or justification in the code path shown. In the context of a multi-source research skill, silent credential access materially increases danger because users may not expect the tool to inspect browser stores or environment secrets to authenticate as them.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

"THREADS_ACCESS_TOKEN",
    ]
    for key in env_keys:
        val = os.environ.get(key)
        if val:
            config[key] = val

• Confidence: 95% confidence
• Finding: os.environ.get(key

Credential Access

High

• Category: Privilege Escalation

Content

config[key] = val

    # Check for config file
    config_file = os.path.expanduser("~/.config/scry/.env")
    if os.path.isfile(config_file):
        with open(config_file) as f:
            for line in f:

• Confidence: 93% confidence
• Finding: .env"

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: vendor/bird-search/lib/twitter-client-base.js:38

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: vendor/bird-search/bird-search.mjs:96

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: vendor/bird-search/lib/cookies.js:134

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: vendor/bird-search/lib/twitter-client-base.js:19