x-ai-radar
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted external data from X (Twitter) timelines and user lists.
- Ingestion points: Content is scraped from
x.com/homeor user-defined Lists via thebrowsersubagent as described in Phase 1. - Boundary markers: Absent. The instructions do not specify the use of delimiters or 'ignore' instructions when passing scraped tweet text to the LLM for relevance judging (Phase 2, step 3) or summarization (Phase 3).
- Capability inventory: The skill utilizes
invoke_subagent(browser) for data retrieval. While the skill explicitly forbids write operations (no publishing, liking, or reposting), the underlying browser tool possesses these capabilities which could be targeted if an injection succeeds. - Sanitization: Absent. There is no evidence of filtering or escaping content from X posts before it is interpolated into the prompt for processing.
- [COMMAND_EXECUTION]: The skill relies on the orchestration of a browser subagent to perform its primary function.
- Evidence: Phase 1 explicitly mandates the use of
invoke_subagentwithTypeName: "browser"to navigate and scrapex.com.
Audit Metadata