The Agent Skills Directory

[CREDENTIALS_UNSAFE]: A hardcoded Twitter Bearer token is included in the reference documentation for downloading images.
Evidence (references/x-article-images.md): BEARER="AAAAAAAAAAAAAAAAAAAANRILgAAAAAAnNwIzUejRCOuH5E6IWNxG7cCWhrP8K8LWul9J2p1QVaQzuH6dNjjsKIwgLexILyG3uK0uV9TPf6p1HLoquG3E2JAw9iAvPygoJ9vXK1ul8PH3Qxm0qyJgDZ" used in curl -H "Authorization: Bearer ${BEARER}".
[COMMAND_EXECUTION]: The skill provides Python scripts that execute shell commands using string interpolation of potentially untrusted data (username and cursor) with shell=True, creating a high risk of command injection.
Evidence (references/x-batch-account.md): cmd = f'xreach tweets @{username} --json -n 100' followed by subprocess.run(cmd, shell=True, capture_output=True, text=True).
[EXTERNAL_DOWNLOADS]: The skill is configured to automatically clone up to five GitHub repositories from untrusted third-party sources (extracted from tweets) without requiring explicit user confirmation.
Evidence (SKILL.md): "1-5 䀀 | 直接 clone，无需确认" and git clone https://github.com/{owner}/{repo}.git.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from X (Twitter) posts and specifically attempts to extract "prompts" (instructions) from text and image metadata to be followed by the agent.
Ingestion points: browser_navigate to external tweet/article URLs, xreach API fetching remote tweet text, and r.jina.ai reading external page content.
Boundary markers: No explicit delimiters or warnings to ignore instructions inside the ingested data are present.
Capability inventory: The skill possesses capabilities for shell command execution, file writing, and remote code downloading (git clone).
Sanitization: No evidence of sanitization or validation of the extracted prompt content before it is processed by the agent.

x-article-download