The Agent Skills Directory

[COMMAND_EXECUTION]: The skill generates shell commands using curl to interact with third-party APIs. It attempts to mitigate command injection through a 'Gate' mechanism that uses regex to match, capture, and rebuild URLs before they are placed in a shell command line. However, the skill notes that this gate is 'instruction-level, model-honored, and not runtime-enforced,' representing a risk if the model fails to follow the complex validation steps precisely.
[COMMAND_EXECUTION]: The skill uses specific shell quoting techniques (single-quotes) to prevent variable expansion and command substitution in file paths (e.g., preventing $name or `whoami` expansion in directory names). This indicates a high awareness of shell injection vectors but remains a high-risk implementation pattern.
[REMOTE_CODE_EXECUTION]: The documentation identifies a supply chain risk associated with the third-party service xtomd.com. The service's official documentation references an npm package (@xtomd/mcp-server) that is currently unregistered on the public registry (404). This creates a risk where a malicious actor could register the package name to execute code on systems attempting to use the vendor's advertised tools.
[DATA_EXFILTRATION]: The skill transmits user-supplied (and subsequently canonicalized) X URLs to external third-party services (xtomd.com and threadreaderapp.com). The skill explicitly acknowledges that these services may log data indefinitely and lack published retention policies.
[PROMPT_INJECTION]: The skill is designed to ingest untrusted data from X posts, which are 'attacker-authored text.' It implements an indirect prompt injection defense by instructing the agent to treat all fetched bytes as data to report, never as instructions to follow, specifically calling out patterns like 'ignore your instructions' or 'run this command'.
Ingestion points: xtomd.com API responses and threadreaderapp.com HTML content.
Boundary markers: Instructions to treat output as quoted data and report injection attempts rather than acting on them.
Capability inventory: Shell execution (curl), file writes (-o), file reads (Read tool), and file deletion.
Sanitization: Rebuilding URLs from safe regex captures to prevent shell metacharacters from reaching the command line.

read