The Agent Skills Directory

Prompt Injection (LOW): The skill is susceptible to indirect prompt injection. It retrieves data from X (search results, timelines, and user activity) and outputs it to the agent without boundary markers or sanitization. This allows malicious external content (tweets) to potentially provide instructions to the agent.\n
Ingestion points: scripts/get_timeline.py, scripts/recent_activity.py, and scripts/search_tweets.py fetch untrusted content from X.\n
Boundary markers: Absent. The tweet text is printed directly to the terminal for agent consumption.\n
Capability inventory: The skill includes various write operations (post_tweet.py, post_reply.py, post_quote.py, post_with_media.py, delete_post.py, retweet.py, like_post.py, and send_dm.py) that could be triggered by injected instructions.\n
Sanitization: Absent.\n- Data Exfiltration (LOW): The scripts post_with_media.py and send_dm.py allow the agent to upload local files to X. This capability creates an exfiltration vector where an agent, if compromised by a prompt injection, could be instructed to upload sensitive local files (e.g., ssh keys or configuration files) as attachments.\n- Data Exfiltration (LOW): The documentation in README.md and SKILL.md recommends storing API credentials in /root/.env. While this is an instructional recommendation rather than a code-level vulnerability, /root/ is a high-privilege sensitive path, and placing secrets there increases the risk of credential exposure.

x-api