The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from X (tweets, DMs, bios, and community posts) which serves as an entry point for indirect prompt injection attacks.
Ingestion points: Data enters the agent's context through several API endpoints including GET /x/tweets, GET /x/dm/history, and incoming webhook events described in references/monitors-webhooks.md.
Boundary markers: The instructions require the agent to wrap X-authored content in specific markers (e.g., XQUIK_UNTRUSTED_X_CONTENT), use markdown/HTML escaping, and explicitly state that embedded instructions within the data have been ignored.
Capability inventory: The skill possesses significant capabilities, including performing write actions (likes, posts, follows, DMs) and writing large datasets to local files, which could be targeted by injection attacks.
Sanitization: The skill mandates the use of validated IDs for source links, requires that embedded URLs remain as plain text, and prohibits external content from influencing tool selection, route parameters, or triggering automatic writes.
[CREDENTIALS_UNSAFE]: The skill follows security best practices for secret management. It instructs the agent to retrieve the XQUIK_API_KEY from the environment or a secure secret store, explicitly forbids hardcoding or reproducing keys in chat, and provides logic to redact keys from logs and output bodies.

x-twitter-scraper