The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes article content from article.md to construct prompts for external image generation models, creating a vulnerability surface where malicious data could influence the resulting prompts.
Ingestion points: Untrusted data enters the agent context via article.md and article.yaml during the prompt engineering phase.
Boundary markers: While the skill uses structured style templates, it lacks explicit delimiters or instructions to ignore embedded commands within the extracted article text.
Capability inventory: The skill utilizes shell execution for scripts/image_create.py, which performs network POST requests via urllib to external endpoints.
Sanitization: The skill does not perform sanitization or filtering of the interpolated article content before sending it to the image model API.
[DATA_EXFILTRATION]: The skill transmits user-configured credentials and article metadata to external services as part of its documented functionality.
The skill reads sensitive API keys from the local aws.env file and transmits them via HTTP headers to user-defined endpoints.
Security Mitigation: The implementation includes a dedicated SSRF defense in scripts/image_create.py (_is_safe_download_url) that validates image URLs returned by APIs, ensuring they resolve only to public IP addresses and blocking access to private or loopback networks.
[COMMAND_EXECUTION]: The skill performs shell execution of internal Python scripts for generation and preparation tasks.
These executions (scripts/image_create.py, scripts/user_image_prepare.py) are restricted to the skill's own codebase and are clearly documented in the capability disclosure section of SKILL.md.

aws-wechat-article-images