x-search-plugin-1f25bb — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited x-search-plugin-1f25bb (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill for read-only X/Twitter research through the local x-search-plugin MCP server.
Do not use this skill for posting, liking, following, DMs, account changes, or other X mutations. The plugin only supports read-only research.
The MCP server needs one usable xAI credential. Prefer local xAI OAuth for entitled X Premium, Premium+, or SuperGrok accounts:
uv run --quiet --locked python scripts/x_search_auth.py loginThe login stores token state under ~/.x-search-plugin/auth.json and the MCP server refreshes the access token before X Search calls. Legacy ~/.x-search-codex/auth.json credentials remain usable when the new store does not exist.
Fallback environment credentials:
XAI_OAUTH_BEARER_TOKENXAI_BEARER_TOKENXAI_API_KEYIf the user asks to authenticate, do not ask them to paste secrets into chat. Tell them to run uv run --quiet --locked python scripts/x_search_auth.py login locally, or put a fallback credential in their local shell, secrets manager, or Codex environment. Never read or print local credential files.
x_search_status first when troubleshooting setup.x_search for flexible research questions, broad reactions, rumor checks,and source-backed summaries.
search_tweets when the user wants a list of recent posts matching aquery, optional language, date range, or specific author.
fetch_tweet when the user provides one X post URL.get_trends when the user asks what is trending in a region.When answering the user:
x_search.lower and recommend broadening filters or retrying.
uv run --quiet --locked python scripts/x_search_auth.py loginor configure one of the supported env vars.
401: credential is invalid or expired; refresh or log in again.403: account entitlement or xAI OAuth/API access issue.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.