The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the xurl CLI tool via Homebrew and clones the mcp-x conversion library from GitHub. These are appropriate for the skill's functionality and the instructions include verification steps such as checking git commit hashes.
[COMMAND_EXECUTION]: The skill uses various shell commands for authentication, media uploading, and posting to X. It also utilizes the Bitwarden CLI (bws) and macOS security tool for secure credential retrieval, avoiding plaintext secrets in configuration files.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided Markdown and MDX files to generate X Article drafts. While this presents a potential surface for indirect injection, the skill mandates a strict human-in-the-loop workflow where the agent must display the final text and receive explicit user authorization before any content is published.
[SAFE]: The skill demonstrates a strong security posture through several defensive measures: it enforces a strict credential boundary where only the official CLI handles secrets, recommends the use of --ignore-scripts during dependency installation, and explicitly forbids verbose logging (xurl -v) that could leak authorization headers.

x-publishing