The Agent Skills Directory

[DATA_EXFILTRATION]: The skill implements functionality to interact with official X (Twitter) API domains (api.x.com, upload.twitter.com) using standard libraries such as requests and requests-oauthlib. These operations are intended for the skill's primary purpose of social media integration. The documentation explicitly warns against hardcoding credentials and suggests using environment variables, which is a security best practice for managing secrets.\n- [PROMPT_INJECTION]: The skill retrieves untrusted content from X (e.g., search results, timelines, and user profiles), creating a surface for indirect prompt injection. Evidence chain: 1. Ingestion points: api.x.com search and user timeline endpoints. 2. Boundary markers: Absent in code snippets. 3. Capability inventory: Ability to post tweets and upload media via authenticated POST requests. 4. Sanitization: Not demonstrated in the provided examples. This exposure is typical for API integration skills and is documented here for architectural awareness.

x-api