The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill instructs the agent to access environment variables for API credentials (e.g., X_BEARER_TOKEN, X_API_KEY). This is a standard and recommended practice for managing secrets in API integrations. Communication is limited to official X API domains (api.x.com and upload.twitter.com).
[INDIRECT_PROMPT_INJECTION]: The skill defines functions to ingest untrusted data from the X API, such as search results and user timelines.
Ingestion points: https://api.x.com/2/tweets/search/recent and https://api.x.com/2/users/{user_id}/tweets (SKILL.md).
Boundary markers: None explicitly defined in the provided code snippets.
Capability inventory: The skill possesses network capabilities to perform POST requests (posting tweets/threads) and GET requests (searching/reading data) via the requests and requests_oauthlib libraries.
Sanitization: The provided examples do not demonstrate sanitization of the fetched API data before processing.
[COMMAND_EXECUTION]: The skill uses Python's requests library to perform HTTP operations, which is the intended purpose of the skill and does not involve arbitrary shell command execution.

x-api