write-like-meng-on-x

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill explicitly instructs drafting and refreshing X/Twitter posts "in Meng To's voice" using his authored-post corpus and profile data, which constitutes content designed to impersonate a real person and is therefore suspicious steering without clear benign context.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow reads outsider-authored free text from X (MengTo profile/latest search) during the “Refresh The Voice Corpus” step, collecting 20–50 recent authored posts/replies/quotes for ingestion into the LLM’s tweet-corpus.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs the agent to use the in-app Codex browser to fetch X content (which is then ingested and directly used as voice/prompting evidence), e.g. https://x.com/MengTo and the search URL https://x.com/search?q=from%3AMengTo&src=typed_query&f=live, so external X pages are fetched at runtime and directly influence generated prompts and outputs.