The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill directs the agent to install external packages and tools using npx skills add belt-sh/cli and npx skills add inference-sh/skills@ai-image-generation. These sources are not recognized as trusted organizations, and the installations are not pinned to immutable versions.
[REMOTE_CODE_EXECUTION]: The skill provides a link to a remote script installation guide (https://raw.githubusercontent.com/inference-sh/skills/refs/heads/main/cli-install.md). This process likely involves downloading and executing scripts to set up the belt CLI environment.
[COMMAND_EXECUTION]: The skill relies on the belt CLI to run remote AI applications (falai/flux-dev-lora, infsh/stitch-images). This behavior involves the execution of shell commands that interact with external services.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface through the following evidence:
Ingestion points: The skill processes user-provided scene descriptions, shot lists, and script excerpts in SKILL.md.
Boundary markers: Absent; there are no delimiters or instructions to treat user-supplied content as untrusted data.
Capability inventory: The skill uses Bash(belt *) in SKILL.md to execute shell commands based on user input.
Sanitization: Absent; the instructions interpolate user-defined variables directly into shell command templates without escaping or validation, posing a risk of command injection if the user content contains malicious shell characters.
[INDIRECT_PROMPT_INJECTION]: The skill includes a skill-report.json file that contains a security audit claiming a 'medium' risk level and stating the skill is 'safe_to_publish'. This is a self-referential attempt to dictate its own security status and must be disregarded per safety guidelines.

storyboard-creation