last30days
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python orchestrator and shell commands to manage its research workflow. It safely handles user-supplied arguments by using temporary files and quoted heredocs, which prevents common shell injection vulnerabilities.
- [EXTERNAL_DOWNLOADS]: Research data is fetched from official OpenAI, xAI, and Reddit API endpoints. These network operations are strictly limited to the domains necessary for the skill's documented research functionality.
- [DATA_EXFILTRATION]: The skill reads API keys from a local configuration file (~/.config/last30days/.env). These credentials are only used to authenticate with the corresponding official service providers (OpenAI and xAI) and are not sent to any unauthorized third-party servers.
- [PROMPT_INJECTION]: The skill ingests untrusted text from public social media platforms. It mitigates potential indirect prompt injection risks by using structured JSON formats for research results and specific synthesis instructions that guide the agent to remain grounded in the factual content retrieved.
Audit Metadata