The Agent Skills Directory

[Indirect Prompt Injection] (LOW): The skill is vulnerable to indirect prompt injection because it ingests untrusted data from external sources and has access to sensitive capabilities. 1. Ingestion points: The agent retrieves untrusted text via xcli search posts, xcli likes list, and xcli bookmarks list. 2. Boundary markers: The skill documentation does not define boundary markers or instruct the agent to ignore instructions embedded in the retrieved data. 3. Capability inventory: The skill has the capability to write sensitive configuration and tokens to the local filesystem using xcli config set and perform authentication actions. 4. Sanitization: There is no evidence of sanitization or filtering of the retrieved tweet content before it is processed by the agent.

xcli