The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references official documentation and repositories hosted on GitHub (github.com/AceDataCloud/Skills). Following the internal security guidelines, these references to a known organization's repository are documented neutrally and do not escalate the verdict.
[CREDENTIALS_UNSAFE]: The skill correctly instructs users to manage sensitive credentials using environment variables (ACEDATACLOUD_API_TOKEN) and .env files, which is a standard and safe practice for secret management. It explicitly warns against including keys in prompts or committing them to version control.
[COMMAND_EXECUTION]: Provides standard curl examples for interacting with a REST API. These are routine integration examples for a web service and do not represent unauthorized or dangerous command execution.
[DATA_EXFILTRATION]: The skill involves sending image data to an external API (api.acedatacloud.com). As this is the core intended purpose of the skill (image processing via a specific vendor) and uses authenticated requests to the vendor's own infrastructure, it is not considered malicious exfiltration.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text prompts to generate images. While this creates an attack surface for indirect prompt injection, it is the fundamental purpose of an image generation skill. The risk is considered low and inherent to the technology, with no specific exploitable capabilities identified beyond standard image generation.

seedream-image