The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The file scripts/constants.ts contains a hardcoded bearer token (DEFAULT_BEARER_TOKEN) used for authenticating requests to the X API. Hardcoding authentication secrets is a poor security practice.
[COMMAND_EXECUTION]: The script scripts/cookies.ts uses child_process.spawn to launch browser executables (Chrome, Edge, or Chromium) from a list of standard system paths or user-defined environment variables. This involves executing system binaries with arguments influenced by environment configurations.
[DATA_EXFILTRATION]: The skill uses the Chrome DevTools Protocol (CDP) to extract sensitive authentication cookies (auth_token, ct0, twid) from a browser session and writes them to a local JSON file (cookies.json) within the user's application data directory. Harvesting session tokens represents a high-impact data exposure capability.
[PROMPT_INJECTION]: The skill processes untrusted content from X (tweets and articles), which provides a surface for indirect prompt injection. Malicious instructions embedded in the source content could potentially influence the behavior of an AI agent processing the resulting markdown.
Ingestion points: Fetches tweet and article content from x.com via scripts/graphql.ts and scripts/thread.ts.
Boundary markers: The generated markdown includes YAML frontmatter but lacks explicit delimiters or warnings to the agent to ignore instructions embedded in the body content.
Capability inventory: The skill scripts can perform file system operations (read/write), network requests, and execute system commands (browser spawning).
Sanitization: Content is converted to markdown format but does not undergo security-specific filtering to neutralize potential natural language instructions.

baoyu-danger-x-to-markdown