The Agent Skills Directory

[PROMPT_INJECTION]: Indirect prompt injection surface identified in scripts/generate_infographic_ai.py. Untrusted data is ingested via the research_topic method using the Perplexity API and interpolated into prompts for the image generation model. While the skill uses headers like 'RESEARCHED DATA AND FACTS' to provide context, it lacks strong delimiters or instructions to ignore embedded commands. The skill possesses file-write and network capabilities, and no sanitization is applied to the researched content.
[COMMAND_EXECUTION]: The script scripts/generate_infographic.py uses subprocess.run() to invoke a secondary script (generate_infographic_ai.py). This is implemented safely using an argument list which mitigates shell injection risks.
[DATA_EXFILTRATION]: The skill performs legitimate network operations to openrouter.ai and perplexity.ai. These requests are necessary for the skill's stated purpose of research and infographic generation.
[CREDENTIALS_UNSAFE]: The skill follows security best practices for secret management by instructing users to provide the OPENROUTER_API_KEY through environment variables or a .env file rather than hardcoding credentials.

alterlab-infographics