The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted social media post text from user-supplied CSV exports (account_analytics_content.csv).
Ingestion points: The text column of the CSV and the ~/.claude/x/log.md file are read into the agent's context.
Boundary markers: The instructions lack delimiters or warnings to treat the post content as data only, potentially allowing embedded instructions to influence the agent.
Capability inventory: The skill aggregates data and passes conclusions to the /x-plan command, creating a path for malicious data to influence future planning actions.
Sanitization: The audit.py script truncates the post text to approximately 44 characters in the ranking output, which provides a minor degree of mitigation by limiting the length of potential injection payloads.
[DYNAMIC_EXECUTION]: The audit.py script dynamically modifies the Python module search path to import logic from a directory outside its own.
Evidence: The script uses sys.path.insert(0, os.path.join(HERE, "..", "x-post")) followed by a conditional import of hookscore.
This pattern involves loading code from relative paths (..), which is a common practice in multi-skill repositories but represents a dependency on the external directory structure.

x-audit