x-article-publisher
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Markdown files or URLs and performs actions in a browser environment (X Articles editor). While the skill's logic is sound, the data ingestion creates a surface where embedded instructions in the Markdown could influence the agent's behavior.
- Ingestion points: The
parse_markdown.pyscript reads Markdown content from user-provided files or URLs. - Boundary markers: The instructions do not explicitly require the use of boundary markers or 'ignore instructions' delimiters when processing the external content.
- Capability inventory: The skill uses Playwright for browser automation (interacting with X.com) and executes local Python and Node.js scripts via shell commands.
- Sanitization: Content is converted to HTML via regex in
parse_markdown.py, but this does not filter out natural language instructions that might target the LLM. - [COMMAND_EXECUTION]: The skill relies on executing several local Python scripts and Node.js command-line tools to process data, convert tables/diagrams to images, and manage the system clipboard.
- Evidence: Execution of
parse_markdown.py,copy_to_clipboard.py,table_to_image.py, and the Mermaid CLI (mmdc).
Audit Metadata