The Agent Skills Directory

[SAFE]: The skill follows security best practices for credential management by instructing the use of environment variables (TWEETSMASH_API_KEY) rather than hardcoding secrets in the skill or assets.
[COMMAND_EXECUTION]: The skill utilizes a local utility script (scripts/build-bookmarks-url.py) to correctly encode query parameters for API requests. This script uses standard Python libraries (argparse, urllib.parse) and performs no dangerous operations.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to ingest and process arbitrary content from an external source (Twitter/X bookmarks).
Ingestion points: Data retrieved from the GET /bookmarks endpoint, specifically the tweet_details.text and tweet_details.meta fields in references/api-reference.md.
Boundary markers: Absent; the instructions do not prescribe the use of delimiters or specific framing when the agent processes the retrieved bookmark content.
Capability inventory: The skill has the capability to perform network requests to the TweetSmash API and execute local helper scripts.
Sanitization: Absent; there is no mention of filtering, escaping, or validating the content returned by the API before the agent interprets it.

tweetsmash-api