The Agent Skills Directory

[DATA_EXFILTRATION]: The TwitterListSource adapter in adapters/twitter_list.py utilizes Playwright's persistent context feature to access a specified Chrome profile directory. This directory contains highly sensitive information, including session cookies, browser history, and potentially saved passwords. Accessing such data presents a significant data exposure risk if the skill is configured to use a user's primary browser profile.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted text from X/Twitter and interpolates it into prompts for the LLM. An attacker could craft a tweet with instructions designed to hijack the agent's behavior during the drafting phase.
Ingestion points: Untrusted content is fetched from social media via the TwitterListSource and FileSource collectors.
Boundary markers: The skill uses a structured list in render_items_block (within core/generate.py) to pass items to the prompt, but it does not employ secure delimiters or markers to strictly isolate this external content.
Capability inventory: The pipeline can perform LLM completions, write to the local file system, and publish to external platforms like Feishu.
Sanitization: The skill includes a dedicated linting pass (core/lint.py) that checks for factual consistency and banned phrases, which provides a layer of defense but does not eliminate the injection risk.
[COMMAND_EXECUTION]: The skill executes a custom JavaScript snippet (_EXTRACT_JS) within the browser context using Playwright to extract data from target web pages. While this execution is limited to the browser environment, it involves running logic against untrusted external content.

tech-intel