The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches untrusted content from public X posts and profiles, creating a surface for indirect prompt injection attacks.
Ingestion points: The tools search_posts, search_all_posts, get_conversation, get_tweet_by_id, and get_user_by_username all ingest text data (tweet text, user descriptions) from an external, attacker-controllable source (X).
Boundary markers: The instructions in SKILL.md do not specify the use of delimiters or provide instructions to the agent to treat the retrieved text as untrusted data.
Capability inventory: The skill provides read access to the X API. The risk level depends on whether the agent has other capabilities (like file writing or shell access) that could be manipulated by instructions hidden in tweet text.
Sanitization: No sanitization or filtering of the retrieved API data is mentioned in the skill definition or documentation.
[SAFE]: The skill uses a workspace vault to manage the X_BEARER_TOKEN via vault.get(), which is a secure practice that prevents the exposure of credentials in logs or chat history.
[SAFE]: External URLs used for documentation and setup (e.g., console.x.com, docs.x.com) belong to a well-known service and are used appropriately.

x-api