x-search
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
hermes-agentpackage from theNousResearchGitHub repository. This is a well-known organization in the artificial intelligence research community. - [COMMAND_EXECUTION]: The skill executes a wrapper script (
run_x_search.py) using a specific Python interpreter located in a local virtual environment created by theuvtool. This is a standard method for running CLI-based tools. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes and summarizes content fetched from X (Twitter). Maliciously crafted posts could potentially attempt to influence the agent's behavior.
- Ingestion points: Output of
run_x_search.pycontaining search results from Grok. - Boundary markers: None identified in the script's output wrapper.
- Capability inventory: The skill uses standard shell execution for the search operation.
- Sanitization: No explicit sanitization of the search results is performed before they are returned to the agent.
- [DATA_EXFILTRATION]: While the skill instructions discuss the location and management of xAI credentials (
auth.json), it does so to guide the user through a legitimate authentication process for the Hermes Agent tool and does not appear to access or transmit these credentials to unauthorized locations.
Audit Metadata