x-twitter-scraper
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill serves as a documentation guide for the Xquik API and MCP server. It facilitates legitimate data retrieval from social media using vendor-provided endpoints at
xquik.comand utilizes appropriate placeholders for API credentials. - [PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted content from X (Twitter), creating a potential surface for indirect prompt injection.
- Ingestion points: Data enters the agent context through social media tools (e.g.,
search-tweets,lookup-tweet,get-user-info) documented inSKILL.md. - Boundary markers: The documentation does not specify the use of delimiters or instructions to ignore embedded commands within the retrieved social media data.
- Capability inventory: The skill facilitates network data retrieval and account monitoring; no local file system access, subprocess execution, or dynamic code evaluation capabilities are defined in the provided file.
- Sanitization: There are no documented procedures for sanitizing or escaping the retrieved external content before it is processed by the agent.
Audit Metadata