The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill accesses the macOS Keychain by executing the /usr/bin/security command to retrieve the 'Chrome Safe Storage' password. This password is used to decrypt the user's browser data.
[CREDENTIALS_UNSAFE]: The script directly reads the Chrome Cookies SQLite database from ~/Library/Application Support/Google/Chrome/ to access encrypted session information.
[COMMAND_EXECUTION]: The script uses node:child_process (execFileSync) to run system binaries like security. This allows the skill to interact with system-level security services outside the typical application sandbox.
[DATA_EXFILTRATION]: The skill extracts highly sensitive auth_token and ct0 session cookies from local storage. Although these are used for communication with official X endpoints, the mechanism enables the extraction of full authentication state from the local machine into the agent's memory.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through external data processed from X.
Ingestion points: Data fetched from X API timelines and user profiles (scripts/x-web-api.mjs).
Boundary markers: None identified; untrusted data from the API is mixed with instructions.
Capability inventory: Ability to perform account actions like unfollowing users (friendships/destroy.json).
Sanitization: The script performs basic regex validation on handles and IDs, but does not sanitize other profile fields that may be presented to the agent.

x-web-api