The Agent Skills Directory

[DYNAMIC_EXECUTION]: The customMapFunction input parameter accepts a JavaScript function as a string which is subsequently executed by the scraper actors at runtime. This provides a mechanism for arbitrary code execution within the actor's environment.
[REMOTE_CODE_EXECUTION]: The skill instructions direct the agent to execute a local file scripts/run_actor.js using Node.js. Since this script is not provided within the skill package, its contents are unverifiable, posing a risk of executing unauthorized code already present in the execution environment.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection due to its core functionality of processing untrusted external content.
Ingestion points: The skill ingests data from Twitter bios and tweets via the Twitter scraper actors (referenced in SKILL.md under the Enrichment and Scoring sections).
Boundary markers: The instructions lack any requirement for boundary markers or delimiters to isolate untrusted Twitter data from the agent's primary instructions.
Capability inventory: The skill environment allows for shell command execution (node, curl) and file system writes (via the --output flag in the suggested CLI commands).
Sanitization: There is no mention of sanitizing, escaping, or validating the content retrieved from Twitter before the agent uses it for scoring and summarization.
[COMMAND_EXECUTION]: The skill documentation provides shell command templates for curl and node. If the $TECH_STACK or other parameters are not properly handled, this could lead to command injection vulnerabilities where a malicious user or indirect prompt could manipulate the shell execution.

finding-software-engineers-on-twitter