Security audit
Security checks across malware telemetry and agentic risk
This looks like a legitimate market-analysis skill, but its optional Twitter/X features ask for sensitive session cookies and pass broad environment data to an external CLI.
Review carefully before installing. Use --no-social or skip Twitter/X setup unless you need it, avoid granting Full Disk Access if possible, keep any .env file private and out of source control, and consider using a separate low-risk X account because copied session cookies can act like login credentials.
for category, query in searches:
try:
env = os.environ.copy()
result = subprocess.run(
[bird_bin, "search", query, "-n", "15", "--json"],
capture_output=True, text=True, timeout=30, env=env
)65/65 vendors flagged this skill as clean.
No suspicious patterns detected.