x-topic-search
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/setup.shscript downloads a setup file from the developer's official repository athttps://raw.githubusercontent.com/FinpeakInc/frevana-cli-releases/refs/heads/main/skills/frevana/scripts/setup.sh. - [REMOTE_CODE_EXECUTION]: The skill executes the downloaded setup script using
bash. This is an intended part of the skill's lifecycle to ensure the local Frevana daemon is initialized and up to date. - [COMMAND_EXECUTION]: The
scripts/search_x_topics.shscript executes thefrevanabinary and uses an embedded Python script to safely construct JSON arguments for the tool call. It uses environment variables and standard JSON serialization to prevent command injection in the argument payload. - [PROMPT_INJECTION]: The skill processes untrusted data from X (Twitter) search results. This presents a surface for indirect prompt injection where malicious content in a post could attempt to influence the agent's summary or subsequent actions. The risk is minimized as the data is handled as input to a summarization task without direct execution privileges.
Audit Metadata