x-api
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill documentation facilitates programmatic interaction with official X API endpoints at
api.x.comandupload.twitter.comfor tasks such as posting and searching content. - [CREDENTIALS_UNSAFE]: The skill explicitly instructs users to manage sensitive API keys and tokens via environment variables rather than hardcoding them, promoting secure development practices.
- [PROMPT_INJECTION]: The skill involves reading external content from X (e.g., tweet search results and timelines), which creates a surface for indirect prompt injection if the ingested data contains instructions that the agent might follow. 1. Ingestion points: API calls in
SKILL.mdthat retrieve tweet text and user descriptions. 2. Boundary markers: None present in the provided code snippets. 3. Capability inventory: Network operations for posting and reading via therequestslibrary. 4. Sanitization: Not explicitly implemented in the example code.
Audit Metadata