x-bookmark-quote-posts

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md’s runtime workflow ingests outsider-authored free text by having the agent open and extract visible text from a user’s X bookmark feed and from the account’s last 100 authored posts (including replies/quote text) via the in-app browser.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent to open and fetch live X pages (e.g., https://x.com/i/bookmarks and https://x.com/) at runtime and to use the retrieved posts as the primary voice/sample for generating drafts, meaning remote content is injected into the model context and directly shapes the agent's outputs.