The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill depends on the baoyu-chrome-cdp package, which is not from a trusted organization. It also encourages the use of npx -y bun to execute scripts, which downloads and runs a runtime from the internet.
[COMMAND_EXECUTION]: The script uses child_process.execSync in scripts/paths.ts to execute shell commands (cmd.exe, wslpath) for path resolution. It also requires the execution of bun or npx to run the main logic.
[CREDENTIALS_UNSAFE]: To authenticate with X, the skill automates a Chrome browser instance using the Chrome DevTools Protocol (CDP) to extract session cookies (auth_token, ct0). While this is a core feature for accessing non-public content, it involves high-privilege access to browser data. The extracted cookies are stored locally in the user's data directory. Note: The hardcoded bearer token in scripts/constants.ts is the standard public token used for guest access to X's web API and is not a private credential.
[INDIRECT_PROMPT_INJECTION]: The skill fetches and processes content from X (tweets and articles) and converts it into Markdown for the agent to read. This untrusted external data could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Content is fetched via GraphQL APIs in scripts/graphql.ts and scripts/thread.ts (e.g., via fetchXTweet, fetchXArticle).
Boundary markers: The output is formatted as Markdown with YAML frontmatter, but there are no explicit instructions to the agent to ignore embedded commands within the tweet content.
Capability inventory: The skill has the ability to write files to the local system and perform network requests to X domains across multiple scripts (scripts/main.ts, scripts/media-localizer.ts).
Sanitization: Content is escaped for Markdown syntax in scripts/markdown.ts, but no filtering or validation for prompt injection patterns is performed.

baoyu-danger-x-to-markdown