x

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow runs scripts/x.py which uses twikit to fetch and parse X web/API responses (outsider-authored content from X) and then prints that scraped text/fields into the agent’s context via stdout JSON.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill dynamically fetches and parses "https://abs.twimg.com/responsive-web/client-web/ondemand.s.{hash_match.group(1)}a.js" at runtime (see scripts/x.py) to derive transaction-key indices that directly control the connector's behavior, so the external JS content influences execution.