x-trends
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFEDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill manages authentication via the X_BEARER_TOKEN environment variable, which is the recommended practice for securing API keys.
- [DATA_EXFILTRATION]: scripts/trends.py makes network requests to api.x.com. As this is the official domain of a well-known service and essential for the skill's function, it is considered safe.
- [SAFE]: The implementation in scripts/trends.py includes a _NoRedirect class to block HTTP redirects, providing protection against Server-Side Request Forgery (SSRF) and credential leakage.
- [REMOTE_CODE_EXECUTION]: Test scripts scripts/test_trends.py and scripts/test_woeid_lookup.py use importlib to execute local script files. This dynamic execution is confined to local paths for testing purposes and does not process external input.
- [EXTERNAL_DOWNLOADS]: The documentation mentions installation via npx clawhub, a utility for managing agent skills. The installation targets the author's own verified package infrastructure.
- [PROMPT_INJECTION]: The skill ingests trend data from the X API; although this data is user-generated, the risk of indirect prompt injection is minimal given the skill's read-only nature and structured output.
Audit Metadata