fetch-tweet
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to
api.fxtwitter.comto retrieve tweet data. This is a well-known and widely used service for accessing tweet content as plain JSON, avoiding the complexities of the official API and JavaScript rendering requirements. - [PROMPT_INJECTION]: The skill processes content from an external source (tweet text), which creates a surface for indirect prompt injection. If a fetched tweet contains instructions intended to manipulate the agent, it could influence behavior. This is a standard risk for web-fetching tools. \n
- Ingestion points: Tweet text and metadata returned from
WebFetchin SKILL.md. \n - Boundary markers: Absent; the skill does not explicitly wrap fetched content in delimiters. \n
- Capability inventory: Uses
WebFetchfor network access. \n - Sanitization: None; the skill presents the raw text of the tweet.
Audit Metadata