x-twitter-viral-radar
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill installs a managed cron job on the local system to execute a Python monitoring script at regular intervals. The script uses subprocess calls to execute the
webcmdutility, employing safe argument handling viashlex.splitand list-based command execution. - [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
@agentrhq/webcmdpackage globally via NPM. This is a vendor-owned utility necessary for accessing the user's authenticated browser session for data scraping. - [DATA_EXFILTRATION]: The script transmits metadata from X (Twitter) posts to external webhook URLs (Discord, Slack, or generic). This network communication is the primary purpose of the skill and is documented as the intended notification mechanism.
- [CREDENTIALS_UNSAFE]: The skill handles webhook credentials but implements robust security measures to prevent exposure. It utilizes native
osascriptdialogs on macOS to collect secrets without them entering the AI conversation history and enforces strict0600file permissions on the configuration file containing the secrets.
Audit Metadata