The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The file scripts/constants.ts contains a hardcoded API bearer token used for authenticating requests to X's GraphQL API.
[COMMAND_EXECUTION]: The skill uses child_process.spawn in scripts/cookies.ts to launch a web browser (Chrome, Edge, or Chromium) with the --remote-debugging-port flag enabled. This allows the script to automate the browser and extract sensitive data.
[DATA_EXFILTRATION]: The skill extracts user session cookies (auth_token, ct0, etc.) via the Chrome DevTools Protocol and stores them in a local JSON file (cookies.json) within the application data directory. These cookies are subsequently used to authenticate network requests to X servers.
[EXTERNAL_DOWNLOADS]: The skill fetches JavaScript bundles from Twitter's web assets (abs.twimg.com) at runtime to extract API parameters and downloads media assets (images and videos) from Twitter's CDN domains (pbs.twimg.com, video.twimg.com).
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from X tweets and articles, converting them into Markdown. This content is then processed by the agent, which could lead to indirect prompt injection if the fetched content contains malicious instructions.
Ingestion points: Data is fetched via scripts/graphql.ts using functions like fetchTweetResult and fetchXArticle.
Boundary markers: The content is formatted into Markdown and YAML front matter but lacks explicit instructions to the agent to disregard instructions found within the data.
Capability inventory: The skill can write files to the local system, launch browser processes, and perform network requests.
Sanitization: The skill performs minimal sanitization, primarily escaping specific Markdown characters in alt-text, but does not validate or sanitize the main text content.

canghe-danger-x-to-markdown