twitter-account-manager

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Required runtime path start → tick() → sense() scrapes X timeline/search/mentions text and feeds it to the LLM via llm_l2_draft(persona, sensed) after wrapping in <EXTERNAL_UNTRUSTED> (outsider-authored tweet/reply/bio/search snippets can be attacker-controlled).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill uses Playwright at runtime to navigate to and scrape content from https://x.com/home (and related x.com pages like https://x.com/login and https://x.com/compose/post), and that scraped external text is injected into the LLM prompts (so remote page content can directly influence model instructions at runtime).