The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from X/Twitter posts and external web pages, creating a surface for indirect prompt injection attacks.
Ingestion points: Untrusted data enters the agent context via tweet text fetched through the X API (scripts/x_api.py) or xAI backend (scripts/x_xai.py), and through external content retrieved using WebFetch as recommended in the research loop (SKILL.md).
Boundary markers: Although tweet text is wrapped in Markdown blockquotes in the formatted output (scripts/x_format.py), there are no explicit system instructions or boundary markers to prevent the agent from following malicious commands embedded within the fetched content.
Capability inventory: The skill execution environment permits powerful capabilities including shell execution (Bash), file modification (Write), and network access (WebFetch), which could be abused if the agent obeys instructions found in processed data.
Sanitization: The skill performs only basic string cleaning (removing t.co links) and does not implement semantic filtering or sanitization of instructions within the ingested data.
[COMMAND_EXECUTION]: The skill executes local Python scripts using the uv tool.
The SKILL.md file defines multiple commands that run the scripts/x_search.py script via uv run to perform its primary functions.
[DATA_EXFILTRATION]: The skill sends search queries and authentication tokens to external services.
Search queries and API credentials are sent to X (api.x.com) and xAI (api.x.ai) endpoints. These operations are directed at well-known, official service domains associated with the skill's purpose.
[SAFE]: Best practices for credential management and data storage.
The skill correctly instructs the user to manage API keys via environment variables rather than hardcoding them (SKILL.md).
File system access is limited to a local cache directory (data/cache/), a watchlist file (data/watchlist.json), and a user-controlled output directory (~/x-research-output/).

x-research