The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided text descriptions to generate images, creating a surface for indirect prompt injection vulnerabilities.
Ingestion points: User input is captured in the PROMPT variable within the Batch Generation Workflow section in SKILL.md.
Boundary markers: The skill does not employ delimiters or specific instructions to the agent to disregard potential commands hidden within the image description text.
Capability inventory: The skill utilizes the Bash tool (specifically curl) to send these prompts to an external API.
Sanitization: No sanitization, escaping, or validation is performed on the user-supplied prompt before it is interpolated into shell commands.
[COMMAND_EXECUTION]: The Batch Generation Workflow section contains a shell script example that is vulnerable to command injection.
Evidence: The script uses double quotes to interpolate the $PROMPT variable within a JSON payload: "{ \"messages\": [{\"role\": \"user\", \"content\": \"$PROMPT\"}] ... }". This allows the shell to expand subshells or backticks if they are present in the user-provided prompt, leading to arbitrary command execution on the host system.

image-generation