The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/fetch_tweets.sh is vulnerable to shell command injection. It accepts user-provided URLs as arguments and interpolates them directly into a curl command string within double quotes (line 26). While it performs a prefix check to ensure the URL starts with a Twitter/X domain, it does not sanitize or escape shell metacharacters such as $(), ` , or ;. An attacker providing a URL like https://x.com/";id;" could execute arbitrary commands on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill fetches untrusted data from Twitter/X via the Jina AI Reader API and returns it directly to the agent's context. This creates a surface for indirect prompt injection, where a malicious post could contain hidden instructions to manipulate the agent. Evidence Chain: 1. Ingestion points: scripts/fetch_tweet.py and scripts/fetch_tweets.sh (reading from Jina API). 2. Boundary markers: Absent. 3. Capability inventory: The agent has the ability to write arbitrary files via scripts/fetch_tweet.py (line 45) and execute shell scripts. 4. Sanitization: Absent.
[EXTERNAL_DOWNLOADS]: The skill retrieves content from Jina AI's official Reader API (r.jina.ai), which is a well-known service for converting web content into markdown format.

twitter-reader