The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches untrusted data from X (Twitter) via the scripts/xfetch.py script, which presents a surface for indirect prompt injection attacks.
Ingestion points: The gql() function in scripts/xfetch.py retrieves tweet and user data from the X GraphQL API.
Boundary markers: No specific delimiters or warnings are used to wrap the retrieved tweet text.
Capability inventory: The script can output data to stdout in various formats, write to a local SQLite database file, and the agent is instructed to process this data.
Sanitization: While structured data formats (JSON, CSV) are used, the actual text content of tweets is not sanitized or filtered for instructions.
[CREDENTIALS_UNSAFE]: The skill interacts with sensitive local credential storage to authenticate requests to X.
The auth extract command uses the browser_cookie3 library to read session cookies directly from browser databases (e.g., Chrome, Firefox).
The script stores and retrieves session tokens (auth_token, ct0) from a local configuration file at ~/.config/xfetch/cookies.json.
A public X bearer token is included in the script; this is a standard non-secret token used for web-based requests.
[COMMAND_EXECUTION]: The script performs dynamic SQL operations when exporting data to SQLite. It implements a protection mechanism (_sql_ident function) that uses a regular expression to sanitize table and column identifiers, ensuring they only contain alphanumeric characters and underscores to prevent SQL injection.

xfetch