reply-maker
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands for file management (mkdir), data processing (jq), and network operations via local utility scripts (./secretcurl and ./notify).
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external social media posts to generate content suggestions.
- Ingestion points: External tweet content and metadata retrieved via the X.AI x_search tool (SKILL.md, Section A1).
- Boundary markers: The agent processes tweet content without explicit delimiters or instructions to disregard embedded malicious text during the drafting phase.
- Capability inventory: The skill's capabilities are restricted to writing local draft files and sending user notifications; it does not possess high-risk execution permissions.
- Sanitization: The skill uses jq to properly escape variables when building API payloads, protecting the outbound search request from command injection.
Audit Metadata