x-api
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides standard programmatic access to the X API using established libraries and official endpoints. No malicious patterns or unauthorized behaviors were detected.
- [CREDENTIALS_UNSAFE]: The skill correctly implements security best practices by using environment variables for credential management and providing instructions to prevent secret leakage in version control.
- [DATA_EXFILTRATION]: All network activity is directed to official, well-known service domains associated with X/Twitter.
- [PROMPT_INJECTION]: The skill enables the ingestion of untrusted data from a public platform, which constitutes an indirect prompt injection surface. This risk is inherent to the primary functionality of a social media integration.
- Ingestion points: Content enters the agent via API search and timeline responses in SKILL.md.
- Boundary markers: The skill does not implement delimiters or specific warnings for processing external content.
- Capability inventory: The skill provides functions for posting content to the X platform.
- Sanitization: API response data is processed without explicit filtering or validation.
Audit Metadata