x-api
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local Python script located at
$HOME/.claude/scripts/x-api-poster.pyusing theBashtool to perform X API operations.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided strings for social media publication.\n - Ingestion points: User input is passed as arguments to the
x-api-poster.pyscript inSKILL.md.\n - Boundary markers: A mandatory confirmation phase (Phase 2) is used to present a preview and obtain explicit user consent.\n
- Capability inventory: The skill has the ability to post content to the public internet and read data from the X API using
Bashas defined inSKILL.md.\n - Sanitization: The skill performs content length validation to ensure compatibility with X API limits.\n- [SAFE]: The skill implements strong security practices by using environment variables for credential management and enforcing a multi-stage workflow with a manual confirmation gate for high-impact actions.
Audit Metadata