skills/trapple/skills/x-search/Gen Agent Trust Hub

x-search

Pass

Audited by Gen Agent Trust Hub on Jun 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the hermes-agent package from the NousResearch GitHub repository. This is a well-known organization in the artificial intelligence research community.
  • [COMMAND_EXECUTION]: The skill executes a wrapper script (run_x_search.py) using a specific Python interpreter located in a local virtual environment created by the uv tool. This is a standard method for running CLI-based tools.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes and summarizes content fetched from X (Twitter). Maliciously crafted posts could potentially attempt to influence the agent's behavior.
  • Ingestion points: Output of run_x_search.py containing search results from Grok.
  • Boundary markers: None identified in the script's output wrapper.
  • Capability inventory: The skill uses standard shell execution for the search operation.
  • Sanitization: No explicit sanitization of the search results is performed before they are returned to the agent.
  • [DATA_EXFILTRATION]: While the skill instructions discuss the location and management of xAI credentials (auth.json), it does so to guide the user through a legitimate authentication process for the Hermes Agent tool and does not appear to access or transmit these credentials to unauthorized locations.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 23, 2026, 04:28 AM