
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Multisource social-media search assistant for sentiment analysis (Reddit, Bluesky, optional Web).
A command-line tool that launches autonomous social-media search agents powered by OpenAI (o3 or o4-mini). Each agent can gather information from:
The collected evidence is summarised and passed to a report compiler model that produces the final analysis. If the compiler feels the results are insufficient, it can request another search round via an internal redo_search
tool.
Quickly answer exploratory questions that benefit from perspectives across traditional web pages, social-media discussion (Reddit) and emerging networks (Bluesky) without juggling multiple APIs or manual browsing.
┌──────────────┐ 1. strategy_model (o3/o4-mini)
│ generate │ • Produces 3-8 search queries
│ search │
│ objectives │
└──────┬───────┘
│queries[]
┌──────▼───────┐ 2. N search agents (agent_model)
│ each agent │ • Picks one query
│ uses tools │ • Calls search_web / search_reddit / search_bsky
└──────┬───────┘
│summaries[]
┌──────▼───────┐ 3. report_model
│ compile │ • Writes final report
│ final report │ • May call redo_search to loop back
└──────────────┘
# (optional) create and activate a virtual environment
python -m venv .venv && source .venv/bin/activate
# install from PyPI
pip install vociro
Set the following variables in your terminal session before running Vociro (no .env file is used):
Variable | Purpose |
---|---|
OPENAI_API_KEY | Your OpenAI key (mandatory) |
REDDIT_CLIENT_ID & REDDIT_CLIENT_SECRET | Reddit app credentials |
BLUESKY_HANDLE & BLUESKY_APP_PASSWORD | Bluesky login (optional – improves rate-limits) |
Examples (Unix shells):
export OPENAI_API_KEY="sk-..."
export REDDIT_CLIENT_ID="abc" REDDIT_CLIENT_SECRET="xyz"
Windows (PowerShell):
setx OPENAI_API_KEY "sk-..."
vociro init # start an interactive research session
Clarification phase — the assistant asks follow-up questions until it proposes a final objective:
READY: <concise objective>
You must then confirm with y
(accept) or n
(explain why, loop continues). Press z
at any prompt to skip the phase entirely.
Source selection
• Reddit and Bluesky are always enabled (sentiment sources).
• DuckDuckGo Web search is optional (default n).
Model selection / number of agents — same as before.
During execution you will see, for each generated search query:
Search — <query>
Tool calls:
1. search_reddit(query='…')
2. search_bsky(query='…')
…
Total cost so far: $0.0123
The agent is encouraged to perform deep dives (many tool calls) on Reddit and Bluesky to surface real user sentiment. The report compiler will call redo_search
automatically if it feels more evidence is required.
If you want a totally non-interactive run you can feed inputs through stdin, e.g.
echo -e "My question\nz\n\n\no4-mini\no3\n" | vociro init | cat
(The first z
skips clarifications.)
build_tool_specs()
.execute_tool()
.usage
field from the OpenAI response and may vary slightly from billing.MIT – do what you like, just don't blame me.
FAQs
Multisource social-media search assistant for sentiment analysis (Reddit, Bluesky, optional Web).
We found that vociro demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.