The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches user-generated content from the Twitter platform through the third-party twitterapi.io API. This content, such as tweet text and user biographies, is passed to the agent, creating a surface for indirect prompt injection attacks where malicious instructions hidden in social media posts could attempt to influence the agent's behavior.
Ingestion points: Data is fetched via curl_json calls to api.twitterapi.io in scripts/twitterapi_io.py.
Capability inventory: The skill is restricted to read-only API access and does not provide tools for writing files or executing shell commands based on the external content.
Boundary markers: Instructions in SKILL.md tell the agent to parse the returned JSON instead of interpreting human text, which helps prevent accidental execution of embedded commands.
Sanitization: The script uses minimal_tweet and minimal_user functions to filter and restrict the specific data fields exposed to the agent.
[CREDENTIALS_UNSAFE]: The skill provides an auth command that accepts an API key as a command-line argument (--api-key). This pattern can lead to the exposure of sensitive credentials in the system's process list or shell history files. The setup-api-key.sh script also passes the API key as a positional argument to an internal Python call during configuration.
[COMMAND_EXECUTION]: The skill uses subprocess.check_output to execute the curl binary for API communication. The command is constructed as a list, and all parameters are URL-encoded, which effectively prevents shell injection vulnerabilities despite handling external input.

twitterapi-io