soia-pkm-clip-x
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface. It fetches untrusted text from X/Twitter and instructs the AI agent to perform summarization and translation. Maliciously crafted tweets containing instructions could potentially override the agent's behavior during these tasks.\n
- Ingestion points: scripts/archive_x.py fetches tweet and article content from the fxtwitter API.\n
- Boundary markers: Absent. The untrusted content is interpolated directly into the Obsidian note template under Markdown headers without delimiters or instructions to ignore embedded commands.\n
- Capability inventory: The skill has filesystem write access to the Obsidian vault via scripts/archive_x.py.\n
- Sanitization: Absent. There are no instructions or filters provided to handle malicious directives embedded within the ingested tweet content.\n- [COMMAND_EXECUTION]: The skill performs internal script orchestration. The synchronization scripts (sync_telegram_export.py and sync_telegram_saved.py) invoke the primary archiving script (archive_x.py) using the subprocess module. This is used for standard batch processing and employs safe argument lists rather than shell strings, minimizing the risk of command injection.\n- [EXTERNAL_DOWNLOADS]: The skill connects to external APIs to retrieve content. It makes HTTP requests to api.fxtwitter.com for tweet metadata and uses the telethon library to connect to Telegram's MTProto servers for syncing saved messages. These are legitimate operations required for the skill's stated purpose and target well-known service providers.
Audit Metadata