The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes untrusted data from external sources to automate social media engagement, which introduces a surface for indirect prompt injection attacks.
Ingestion points: The agent ingests external data by fetching mentions from the Twitter API (saved to mentions.json) and researching trending topics using the web_search tool.
Boundary markers: There are no explicit delimiters or 'ignore' instructions in the system prompt to prevent the agent from being influenced by malicious commands embedded in the external content it reads.
Capability inventory: The agent has access to powerful tools like shell_exec, file_write, and schedule_create, which could be exploited if an injection attack successfully manipulates the agent's logic.
Sanitization: The instructions provide behavioral guidelines (e.g., 'never engage with trolls') but lack technical sanitization or validation logic for inputs received from external sources.
[COMMAND_EXECUTION]: The agent uses shell_exec to interact with the Twitter API via curl and to check system information with python. While these operations target a well-known service (Twitter) for their intended purpose, the dynamic construction of shell commands involving generated text or web data presents a potential risk of command injection if the agent fails to properly escape input characters (such as quotes) when building the command strings.

twitter-hand-skill