The Agent Skills Directory

[SAFE]: The skill handles user authentication via the X_COOKIES environment variable. Both the instructions and the accompanying script include explicit warnings and logic to prevent the accidental logging or printing of these sensitive credentials.
[SAFE]: All write-capable operations (such as posting, liking, or following) are protected by a mandatory dry-run and confirmation workflow. The agent must first show the user the result of a dry-run and then re-execute the command with a specific --confirm flag, ensuring human-in-the-loop oversight.
[SAFE]: The skill utilizes the twikit library for X API interaction. It includes runtime monkeypatching to resolve transaction ID keys from X's CDN (abs.twimg.com), which is a legitimate technical requirement for scraping compatibility and does not execute untrusted code.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because it ingests untrusted data from X (tweets and profiles) and has significant execution capabilities.
Ingestion points: Untrusted content enters the agent's context through search and timeline commands in scripts/x.py.
Boundary markers: The script outputs data in JSON format but does not utilize specific delimiters or instructions to ignore embedded commands in the tweet text.
Capability inventory: The skill provides tools for state-changing actions including posting, threading, following, and deleting tweets.
Sanitization: No sanitization or content filtering is performed on the ingested tweet data.
Mitigation: The risk is effectively mitigated by the platform-enforced confirmation gate that prevents any automated follow-up actions without explicit user approval.

x