The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content (tweets) to generate draft replies, which creates a potential surface for indirect prompt injection.
Ingestion points: External content is retrieved via the tw task create command and displayed to the agent for processing (SKILL.md).
Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the ingested tweet data.
Capability inventory: The skill can perform state-changing actions on Twitter/X (tw action reply) and execute local CLI commands.
Sanitization: No explicit sanitization of the fetched tweet text is performed prior to the drafting phase.
Mitigation: The risk is mitigated by a strict human-in-the-loop requirement, where every generated reply must be manually reviewed and approved by the user before dispatch.
[EXTERNAL_DOWNLOADS]: The skill manifest (skill-manifest.json) references external URLs for updates and configuration management.
It fetches a release index from the author's official GitHub repository (github.com/ohmyskyhigh).
It provides setup documentation via the threadwave.xyz domain.
these external connections are standard for the skill's operation and update lifecycle.

twitter-reply