The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-provided text prompts to generate visual assets, which is a standard surface for indirect prompt injection.
Ingestion points: User input flows through the prompt field and the design_config object in the SKILL.md examples.
Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within the user prompt.
Capability inventory: The skill utilizes network operations (curl) to send data to an external API endpoint.
Sanitization: There is no evidence of sanitization or filtering of the user-provided prompt before it is sent to the backend service.
[EXTERNAL_DOWNLOADS]: The documentation references external resources and tools for operation.
The skill instructs the use of npx onekey, which involves fetching and executing the onekey package from the npm registry.
It utilizes curl to send POST requests to https://agent.deepnlp.org/agent_router, which is the vendor's API gateway.

image-generator