The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/build-x-guest-check-eval.mjs contains a hardcoded Bearer token (AAAAAAAAAAAAAAAAAAAAANRILg...). While this specific value is widely recognized as a public token for the X web application, hardcoding authentication tokens within source code is generally considered a sub-optimal security practice.
[DYNAMIC_EXECUTION]: The skill utilizes scripts to generate JavaScript function strings (evaluate_script) that are intended to be executed within the user's browser session via Developer Tools. This pattern of dynamic code generation and browser-side execution is used to scrape guest tables and perform relationship lookups, bypassing standard API interfaces.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data provided by users during Luma event registration (such as names, affiliation text, and X profile links).
Ingestion points: Data is read from Luma's guest table and registration_answers fields via the extract-luma-api-candidates.mjs and build-luma-extract-eval.mjs scripts.
Boundary markers: The instructions suggest distinguishing candidates by specific IDs and spot-checking results, but do not implement strict delimiters or explicit warnings to the agent to ignore potentially malicious instructions embedded in the ingested text.
Capability inventory: The skill has the capability to perform network requests via the browser's authenticated session (using fetch with session cookies) and can write or read local files via the provided Node.js scripts.
Sanitization: The skill normalizes X handles using regular expressions, but other fields like affiliation are processed using simple string matching (e.g., checking if a label contains certain keywords) without robust sanitization of the input content.
[COMMAND_EXECUTION]: The skill's workflow requires the execution of several local Node.js scripts (extract-luma-api-candidates.mjs, build-luma-extract-eval.mjs, build-x-guest-check-eval.mjs) via the command line to process data and generate browser-executable payloads.

luma-participant-check