The Agent Skills Directory

[DATA_EXFILTRATION]: The skill reads an API access key from a local file (~/.unsplash) and includes it in headers for network requests. It employs security best practices by instructing the user to set file permissions to 600, ensuring the secret is only accessible to the owner.
[EXTERNAL_DOWNLOADS]: The skill performs network operations via curl to interact with the well-known Unsplash API (api.unsplash.com). It also performs a mandated download tracking request to a location URL provided dynamically in the API response.
[PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it retrieves and processes untrusted data from an external API.
Ingestion points: Metadata such as photo descriptions, alt text, and photographer usernames are ingested from the Unsplash search API response in the primary workflow.
Boundary markers: No specific delimiters or instructions are used to distinguish external API content from the agent's instructions when displaying results to the user.
Capability inventory: The skill utilizes shell commands for file reading (cat), file writing (echo), and network communication (curl).
Sanitization: There is no explicit sanitization or filtering of the string content returned from the external API before it is interpolated into the final output.

unsplash