skills/aibot88/sec_skill_store/mktg-x/Gen Agent Trust Hub

mktg-x

Pass

Audited by Gen Agent Trust Hub on Jun 16, 2026

Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PROMPT_INJECTION]: The skill processes untrusted third-party data from X (tweets, threads, articles), creating an attack surface for indirect prompt injection.\n
  • Ingestion points: Reads content from x.com via scripts/fetch-x.ts (SKILL.md).\n
  • Capability inventory: Utilizes bun for script execution and jq for data processing.\n
  • Sanitization: Implements sanitize.ts to strip terminal escape sequences (OSC/CSI) and warns that fetched content must be treated as data, not instructions.\n- [EXTERNAL_DOWNLOADS]: Retrieves content and configuration from well-known Twitter/X service infrastructure.\n
  • Evidence: Accesses the X GraphQL API and retrieves JavaScript bundles from the official CDN (abs.twimg.com) to dynamically refresh operation IDs.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 16, 2026, 12:59 AM
Security Audit — agent-trust-hub — mktg-x