The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The SKILL.md documentation includes a command pattern that pipes output from curl directly to python3. While the provided example uses the -c flag for parsing JSON, the structural pattern of piping remote network content into an interpreter represents a significant execution risk surface if modified or redirected.
[EXTERNAL_DOWNLOADS]: The scripts/fetch_article.py script utilizes uv run --with twitter-cli to dynamically download and execute the twitter-cli package from a remote registry at runtime. This practice bypasses static dependency pinning and introduces supply chain risks, as the code executed is determined at the time of invocation.
[COMMAND_EXECUTION]: The scripts fetch_article.py, fetch_tweet.py, and fetch_tweets.sh use subprocess.run or direct shell execution to call system binaries like curl and uv. Although basic URL prefix validation is performed, passing user-supplied URLs as arguments to these tools increases the attack surface for potential command injection or exploitation of the underlying binaries.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill retrieves content from external, untrusted sources including Twitter/X posts and long-form articles via scripts/fetch_article.py and scripts/fetch_tweet.py.
Boundary markers: The skill lacks explicit boundary markers or instructions to the agent to ignore embedded commands when processing the fetched content.
Capability inventory: The skill possesses capabilities to write files to the local system (Path.write_text) and execute shell commands (subprocess.run).
Sanitization: While filenames are sanitized to prevent path traversal, the actual content of the tweets and articles is not filtered for malicious instructions or prompt injection attempts.

twitter-reader