The Agent Skills Directory

[PROMPT_INJECTION]: The skill is designed to ingest and process content from social media platforms (X, LinkedIn, Reddit, etc.) which are untrusted external sources. This creates a surface for indirect prompt injection, where malicious instructions hidden within social posts could potentially influence the agent's subsequent behavior once the data is parsed and integrated into the workflow.
Ingestion points: Social media content fetched via public APIs, scraping fallback services, and the Wayback Machine (SKILL.md, references/strategies.md).
Boundary markers: The skill utilizes a structured JSON schema for normalization (references/output-schema.md), which serves as a data boundary.
Capability inventory: The skill has the ability to execute shell commands (curl), interact with a browser (agent-browser), and write to the local file system (caching and media downloads).
Sanitization: No specific filtering or sanitization logic is described to handle potentially malicious natural language instructions embedded within the fetched posts.
[COMMAND_EXECUTION]: The strategy guide in references/strategies.md contains multiple bash script templates that incorporate user-controlled variables (e.g., <handle>, <id>, <rkey>) directly into command strings. If the agent does not rigorously sanitize these fragments before interpolation, it could lead to command injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill performs numerous network operations to non-whitelisted domains, including various social media platform APIs, Nitter mirror instances, and third-party scraping services such as ScrapeCreators and Apify.
[DATA_EXFILTRATION]: The instructions direct the user to store sensitive credentials in environment variables and subsequently transmit these secrets ($SCRAPECREATORS_API_KEY and $APIFY_API_TOKEN) to external third-party domains via HTTP headers. While required for the intended functionality, these destinations are not classified as trusted or well-known organizations.

social-fetch