The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install the bird CLI tool from unverified third-party sources: a custom Homebrew tap (steipete/tap/bird) and an npm package (@steipete/bird).
[COMMAND_EXECUTION]: The skill relies on executing shell commands to install software (npm install -g, brew install) and to interact with the social media platform through the bird binary.
[CREDENTIALS_UNSAFE]: The tool operates using session cookies (auth_token, ct0) and can be configured to read directly from browser profile directories (e.g., Arc, Chrome, Firefox). This exposes sensitive authentication state to the agent and any processed content.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8):
Ingestion points: Fetches untrusted data from X/Twitter via bird read, bird home, bird search, and bird mentions (SKILL.md).
Boundary markers: Absent. There are no instructions to the agent to treat fetched tweet content as untrusted data or to use delimiters.
Capability inventory: The agent can post content (bird tweet), reply to users (bird reply), and modify the social graph (bird follow), providing a significant impact surface for successful injections.
Sanitization: Absent. Content is processed directly without filtering or escaping.
[DATA_EXFILTRATION]: The skill provides capabilities to read private user data (bookmarks, timeline) and manage session cookies, which could be exfiltrated if the agent is directed to send this information to an external endpoint via the CLI tool's network capabilities.

bird