The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/export_x_cookies_from_chrome.py uses subprocess.run to execute the macOS /usr/bin/security utility. This is required to retrieve the Chrome Safe Storage password from the system keychain, which is then used to decrypt local browser cookies for X/Twitter login. This is a transparently documented requirement for the skill's stated purpose.
[CREDENTIALS_UNSAFE]: The skill is designed to handle sensitive session tokens by exporting them from the browser to a local file. To mitigate risk, the exporter script restricts itself specifically to X and Twitter domains and enforces strict file system permissions (chmod 0600) on the resulting JSON. It also includes logic to verify that storage directories are not symbolic links, preventing potential redirection of sensitive data.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided Markdown files through scripts/parse_markdown.py. While this presents an attack surface where malicious instructions could be embedded in Markdown content, the skill uses a robust verification pipeline—including dHash signatures for images and code-point length checks—to ensure the agent only performs actions consistent with the source document.
Ingestion points: Markdown files read via scripts/parse_markdown.py.
Boundary markers: Uses unique tokens like X_TABLE_MARKER and Base64-encoded placeholders for code blocks to separate data from instructions during parsing.
Capability inventory: Browser automation via Playwright, local shell execution for credential retrieval, and file system writes for artifacts.
Sanitization: Implements HTML escaping and protects fenced code blocks to prevent interpretation of embedded markup as instructions.
[DYNAMIC_EXECUTION]: The test utility tests/test_local_contracts.py dynamically loads the skill's Python scripts using importlib for verification purposes. This behavior is isolated to the testing environment and is a standard method for unit testing independent scripts.

x-article-draft-uploader