search-x
Pass
Audited by Gen Agent Trust Hub on Mar 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: Comprehensive analysis of the skill's logic and scripts found no evidence of malicious behavior, backdoors, or security violations.
- [PROMPT_INJECTION]: The skill's instructions do not contain patterns intended to bypass safety guardrails or override agent behavior. The script's prompt construction for the Grok API is well-defined and purpose-specific.
- [DATA_EXFILTRATION]: No unauthorized data transmission was found. The skill correctly utilizes environment variables (
XAI_API_KEY,X_BEARER_TOKEN) for authentication and only communicates with official domains (api.x.ai,api.x.com). - [EXTERNAL_DOWNLOADS]: The skill fetches tweet data from trusted service endpoints. According to analysis rules, these well-known services are considered safe sources for the skill's intended functionality.
- [REMOTE_CODE_EXECUTION]: The skill uses native Node.js libraries and contains no external dependencies or patterns that would allow for remote script execution.
- [PROMPT_INJECTION]: (Category 8: Indirect Prompt Injection) The skill processes external content from X, which is an untrusted source. While this represents a potential injection surface, the risk is negligible as the skill lacks dangerous capabilities.
- Ingestion points: External tweets retrieved via HTTPS in
scripts/search.js. - Boundary markers: None; data is presented as standard text output.
- Capability inventory: No file system access, arbitrary command execution, or dynamic code evaluation capabilities were found in the code.
- Sanitization: Content is retrieved and displayed without modifications, but no execution context is provided for the data.
Audit Metadata