The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill directs the user to install an external package and a skill definition from an unverified third-party repository.
Evidence: npx skills add ndesv21/socialclaw and npm install socialclaw@0.1.12.
The repository ndesv21/socialclaw and the npm package socialclaw do not originate from a recognized trusted organization or a well-known service provider.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external social media platforms, such as analytics and status reports, which could contain malicious instructions designed to influence the agent.
Ingestion points: Data retrieved from social media platforms (X, LinkedIn, etc.) and performance metrics fetched via the socialclaw service.
Boundary markers: The skill instructions do not specify the use of delimiters or protective prompt wrappers when handling external data.
Capability inventory: The skill has the capability to perform authenticated writes (post, delete, schedule) across a wide range of social media platforms.
Sanitization: No evidence is provided regarding the sanitization or validation of data returned from external APIs before it is incorporated into the agent's context.

socialclaw