The Agent Skills Directory

[PERSISTENCE]: The SKILL.md instructions suggest persisting sensitive credentials by appending export commands to the user's shell configuration files (~/.bashrc or ~/.zshrc).
[COMMAND_EXECUTION]: The wrapper script scripts/run_search.sh accesses and executes content from local configuration files using a combination of grep and eval to retrieve the TWITTER_API_KEY environment variable.
[EXTERNAL_DOWNLOADS]: The shell script scripts/run_search.sh includes logic to automatically install the requests library via pip3 install --user if it is missing from the environment. Additionally, the Python script fetches data from a non-whitelisted third-party domain api.twitterapi.io.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze up to 1000 tweets, which are untrusted third-party inputs that could contain malicious instructions.
Ingestion points: scripts/twitter_search.py retrieves tweet content from the Twitter API wrapper.
Boundary markers: The instructions lack explicit delimiters or guidance for the agent to treat tweet content as untrusted data or to ignore embedded instructions within the tweets.
Capability inventory: The skill possesses network access capabilities and the ability to execute local shell and Python scripts.
Sanitization: The script performs structural extraction of JSON fields but does not sanitize or filter the raw tweet text for potential injection attacks before the agent analyzes it.

twitter-search