The Agent Skills Directory

[DATA_EXFILTRATION]: The extension captures Twitter GraphQL responses containing user engagement data (likes, tweets, profile info) and transmits it to external endpoints including https://api.heartdevs.com/analytics/ingest and https://api.heartdevs.com/webhook/twitter. This data collection happens passively in the background as the user browses.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from X/Twitter with the following characteristics:
Ingestion points: Intercepts UserTweets, Favoriters, and TweetDetail GraphQL responses from api.x.com and api.twitter.com via global fetch patching in interceptor.js.
Boundary markers: None. The skill does not use delimiters or instructions to prevent the agent from obeying commands embedded in captured tweets or bios.
Capability inventory: The skill includes capabilities for network operations (fetch in background.js), file writing (chrome.downloads.download in downloadJSON), and local data persistence (chrome.storage.local).
Sanitization: The skill lacks robust sanitization of the intercepted data before it is processed or displayed in the popup UI, although a placeholder for escapeHtml is mentioned in a snippet.

he4rt-twitter-engagement-tracker