cursor-x-mcp-guide
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides operational guidelines for an X API integration. It includes strong security posture instructions, specifically directing the agent to never ask for user keys, passwords, or bearer tokens, and to avoid signing users in through the agent's internal browser environment.
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch live pricing data from https://console.x.com/api/credits/pricing. This is a reference to an official domain for a well-known service (X/Twitter) used for legitimate cost-awareness functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from X (posts, timelines, and search results), which constitutes an untrusted data surface.
- Ingestion points: X search results, home timelines, mentions, and bookmarks via X MCP tools.
- Boundary markers: No specific delimiters for external content are defined in the instructions.
- Capability inventory: The skill can perform searches, post updates, and manage bookmarks using the allowed X tools.
- Sanitization: No explicit sanitization or filtering of the ingested content is mentioned before displaying it to the user.
Audit Metadata