The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to use npx onekey, which downloads and executes the onekey package from the npm registry. This facilitates the execution of third-party software from an unverified source.
[EXTERNAL_DOWNLOADS]: The skill uses curl to interact with external endpoints at agent.deepnlp.org and references assets from us-static.aiagenta2z.com and craftsman-agent.aiagenta2z.com.
[COMMAND_EXECUTION]: The documentation includes shell commands for environment variable configuration (export), network requests (curl), and package execution (npx), which the agent is directed to run.
[PROMPT_INJECTION]: The skill processes user-provided text prompts for image generation which are then passed to a remote API. This represents an attack surface for indirect prompt injection, as there are no boundary markers or sanitization logic present to prevent malicious instructions within the prompt from influencing the AI model.
Ingestion points: The prompt and images parameters in the curl and npx examples in SKILL.md.
Boundary markers: None identified.
Capability inventory: Network requests via curl and code execution via npx as documented in SKILL.md.
Sanitization: None identified.

photo-editor