The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The file scripts/constants.ts contains a hardcoded Bearer token (DEFAULT_BEARER_TOKEN) used to authenticate requests to X's internal GraphQL API.
[COMMAND_EXECUTION]: The skill utilizes shell commands (cat, test) within SKILL.md to verify user consent and preference files in local directories. Furthermore, scripts/cookies.ts spawns local browser processes (Chrome or Edge) using node:child_process to facilitate cookie extraction.
[DATA_EXFILTRATION]: The skill uses the Chrome DevTools Protocol (CDP) in scripts/cookies.ts to programmatically extract active session cookies (auth_token, ct0, twid) from the user's browser. These cookies are saved to a local file (cookies.json) in the user's application data directory (~/Library/Application Support/ or ~/.local/share/). While used for authentication, this involves the programmatic harvesting and storage of sensitive session identifiers.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted user-generated content from X (tweets and articles) and converts it into markdown for the agent's context.
Ingestion points: Tweet and article content retrieved from X via scripts/graphql.ts and scripts/thread.ts.
Boundary markers: None; the content is interpolated directly into the markdown output without delimiters or warnings for the agent to ignore embedded instructions.
Capability inventory: The skill has capabilities for file system modification (writeFile, rename, mkdir), network access (fetch), and process spawning (spawn).
Sanitization: The ingested text is formatted into markdown using logic in scripts/markdown.ts and scripts/thread-markdown.ts, but it is not sanitized or escaped to prevent the inclusion of malicious instructions.

read-x-markdown