The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions include a manual installation method that downloads a shell script and pipes it directly into bash (curl -fsSL https://raw.githubusercontent.com/xdevplatform/xurl/main/install.sh | bash). This practice is inherently risky as it executes unverified code from a repository that is not part of the recognized trusted organizations list.
[PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted external content from the X API, which constitutes a surface for indirect prompt injection attacks.
Ingestion points: Data retrieval commands such as xurl search, xurl read, xurl mentions, and xurl dms in SKILL.md bring external user-generated content into the agent's context.
Boundary markers: The instructions lack the use of clear delimiters or instructions to treat the API-returned content as untrusted data.
Capability inventory: The agent is empowered to perform sensitive actions including posting tweets, deleting content, following users, and sending direct messages through the xurl tool.
Sanitization: There are no instructions for sanitizing, escaping, or validating the data retrieved from the API before it is processed by the agent.
[COMMAND_EXECUTION]: The skill is built around the execution of the xurl CLI tool, which allows the agent to execute shell commands that interact with the local filesystem (e.g., uploading media) and external web services.
[CREDENTIALS_UNSAFE]: The skill identifies and references a sensitive local credential file at ~/.xurl. While the instructions include strong negative constraints to prevent the agent from reading or exfiltrating this file, the explicit mention of the path and the reliance on agent-side policy adherence presents a potential risk.

xurl