The Agent Skills Directory

[COMMAND_EXECUTION]: The social-inbox.mjs script executes shell commands using execSync where the search query is passed inside a shell command string. While JSON.stringify is used on the query, it does not escape shell-active characters such as $() or backticks. This allows an attacker to execute arbitrary commands if they can influence the search term or if the search term is derived from malicious external content. Evidence: The runTwitterApi function in social-inbox.mjs passes the search command string directly to execSync.
[PROMPT_INJECTION]: The skill implements an indirect prompt injection surface by fetching mentions and search results from X/Twitter and presenting them to the agent for processing. 1. Ingestion points: Untrusted tweet content is fetched in social-inbox.mjs via the mentions and search commands. 2. Boundary markers: The output JSON file social-inbox.json does not use delimiters or instructions to warn the agent about potentially malicious content within the tweet text. 3. Capability inventory: The skill uses execSync to run local scripts, and the agent's instructions in SKILL.md encourage it to read the inbox and draft replies, creating a path for malicious instructions in tweets to influence agent actions. 4. Sanitization: There is no evidence of sanitization or filtering of the tweet text before it is saved to the inbox and read by the agent.

social-inbox