The Agent Skills Directory

[COMMAND_EXECUTION]: The skill bundle contains a mechanism for arbitrary command execution in lib/backend_selector.py. The publish function can be configured to use a 'DIY' backend by setting the X_SKILLS_CUSTOM_POSTER environment variable. This variable's content is parsed using shlex.split() and executed via subprocess.run(). This allows for the execution of arbitrary system commands if the environment variable is manipulated or maliciously configured.
[INDIRECT_PROMPT_INJECTION]: The skill bundle is vulnerable to indirect prompt injection due to its architecture for reading and processing external social media content.
Ingestion points: Untrusted data enters the agent context through lib/apify_client.py, which fetches tweets, replies, and niche data via the Apify API.
Boundary markers: Prompts in skills like x-hook-extractor and x-audience-insights lack strong delimiters or instructions to ignore instructions embedded within the fetched data.
Capability inventory: The agent has the capability to perform network requests and execute shell commands (as documented in Category 2).
Sanitization: There is no evidence of sanitization, filtering, or validation of the external content before it is interpolated into the agent's reasoning process.
[EXTERNAL_DOWNLOADS]: The skill bundle performs network operations to several third-party APIs for its core functionality. These include:
api.publora.com for publishing posts.
api.pixfaro.com for image generation.
api.apify.com for reading X (Twitter) data. While these are associated with well-known services for the skill's stated purpose, they represent a significant dependency on external infrastructure.
[REMOTE_CODE_EXECUTION]: A file reputation scanner has confirmed the presence of a malicious file (.codex-marketplace/x-skills/lib/url_parser.py flagged as FileRepMalware [Misc]). This detection indicates that the bundle may contain unauthorized or harmful code, potentially leading to remote compromise.

x-marketing