x-tracker
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from X (tweets and bookmarks) using LLM sub-agents for its rewrite feature. It lacks explicit boundary markers or sanitization for this input.
- Ingestion points: External content is ingested from local archives in
data/following-tweets/anddata/bookmarks/viascripts/analyze.ts. - Boundary markers: The sub-agent instructions in
SKILL.mddo not specify the use of delimiters to isolate the untrusted tweet text from the instructions. - Capability inventory: The skill possesses capabilities to write to X (
post-tweet.ts), write to Notion (notion.ts), and perform network operations (api.ts). - Sanitization: There is no evidence of escaping or filtering of the tweet content before it is processed by the AI.
- [DATA_EXFILTRATION]: The
weekly-sync-following.tsscript sends updates about the user's following list to an external Discord channel using a user-supplied bot token. - [COMMAND_EXECUTION]: The skill requires the execution of various local TypeScript scripts using the Bun runtime to facilitate data synchronization and API interactions.
Audit Metadata