The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data (text prompts and source images) which are interpolated into API requests sent to external 3D generation providers.
Ingestion points: The prompt and images parameters in the toy_generator_design_draft and toy_generator_task_create APIs ingest external content.
Boundary markers: The skill documentation does not specify the use of delimiters or instructions to ignore embedded commands within the user-supplied prompts.
Capability inventory: The skill performs network operations via the OneKey Gateway (agent.deepnlp.org) and provides instructions for executing shell commands via curl and npx.
Sanitization: There is no evidence of input validation or sanitization before the data is passed to the generation models.
[OBFUSCATION]: The file contains a markdown comment using HTML entities (( and )) to escape parentheses in a URL reference. While this is likely for markdown compatibility, it technically represents a form of character encoding within a hidden metadata section.

figurine-generator