lov-search-twitter

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSPERSISTENCECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches Twitter post data and historical snapshots from external sources including the Internet Archive (web.archive.org), Common Crawl (commoncrawl.org), and third-party renderers (api.fxtwitter.com and api.vxtwitter.com). These are well-known services or standard utilities for data recovery.
  • [PERSISTENCE]: Implements a cross-session user profile system using scripts/profile_store.py. This script stores user-stated preferences, brand information, and workspace settings in a local JSON file located at ~/.config/agent-skills/profile.json (or platform equivalents). It includes a denylist to prevent the storage of sensitive data such as tokens or passwords in the profile records.
  • [COMMAND_EXECUTION]: The workflow involves executing internal Python scripts (search_twitter.py and profile_store.py) to process status IDs, extract text from HTML/JSON responses, and register screenshot evidence. These actions are aligned with the skill's stated purpose of recovering verbatim X content.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: The skill ingests raw HTML and JSON data from external web sources and archives via scripts/search_twitter.py.
  • Boundary markers: The SKILL.md instructions explicitly require the agent to label verbatim text separately from translations or summaries, providing a clear boundary for the model to prevent accidental instruction following from external content.
  • Capability inventory: Capabilities include network access via the urllib library and local file writes to the profile configuration file.
  • Sanitization: The skill uses HTML parsing and regex extraction to isolate specific post content from the surrounding page source, rather than interpolating raw page data directly into prompts.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 03:06 AM
Security Audit — agent-trust-hub — lov-search-twitter