The Agent Skills Directory

[DATA_EXFILTRATION]: The skill communicates with xquik.com, which is the primary service domain for the stated functionality. It provides clear instructions for handling API keys via environment variables and specifically warns against including credentials in source files, logs, or chat transcripts.
[PROMPT_INJECTION]: The skill addresses indirect prompt injection by mandating the use of the <XQUIK_UNTRUSTED_X_CONTENT> boundary for any data retrieved from X. It instructs the agent to treat this content as data only and never follow instructions found within it.
[COMMAND_EXECUTION]: While the skill provides curl and bash examples for documentation purposes, these are for the developer's setup and are not dynamically executed by the skill itself. The skill correctly identifies that agent interactions should occur through the defined REST or MCP endpoints.
[CREDENTIALS_UNSAFE]: The skill explicitly instructs the agent to never request sensitive user data such as X passwords, 2FA codes, cookies, or session exports. It uses a standard x-api-key header for authentication with the service provider.
[SAFE]: The skill implements strict approval gates for any 'write' actions (posting, following, etc.), bulk extractions, or persistent monitors, ensuring human-in-the-loop control for high-impact operations.

xquik