The Agent Skills Directory

[SAFE]: The skill implements a design analysis utility using the OpenAI GPT-4 Vision API. Network communication is directed to the well-known service domain api.openai.com. API credentials are managed via environment variables (COZE_OPENAI_VISION_API_<skill_id>), which is a standard security practice for credential handling in agent environments.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-uploaded screenshots, which presents a surface for indirect prompt injection if an image contains adversarial text intended to influence the vision model's behavior.
Ingestion points: Untrusted image data is passed to scripts/analyze_design.py via the --image parameter and subsequently forwarded to the vision model.
Boundary markers: The system prompt provides a structured analysis framework, though it does not include specific instructions to the model to disregard textual instructions embedded within the image itself.
Capability inventory: The skill is limited to making API requests and writing structured results to the local filesystem or standard output; it does not have the capability to execute system commands or modify system configurations.
Sanitization: The script performs image validation using the Pillow library to verify that the input is a well-formed image file before it is processed.

web-design-analyzer