The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external image data via provided URLs, which could serve as a vector for indirect prompt injection if the image content contains adversarial instructions intended to influence the agent's behavior during or after processing.
Ingestion points: The image parameter in the JSON payload of the curl commands within SKILL.md.
Boundary markers: The instructions do not specify any delimiters or safety prompts to isolate the external image content from the agent's core logic.
Capability inventory: The skill utilizes Bash to execute curl commands and has WebFetch listed in its allowed tools, enabling it to retrieve and send data.
Sanitization: There is no evidence of input validation or sanitization for the provided image URLs or the returned API data.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to api.eachlabs.ai to send image data and receive processed results. While this is the primary function of the skill, the domain is outside the standard whitelisted services.
[COMMAND_EXECUTION]: The skill provides specific templates for executing curl commands in a shell environment to interact with a third-party API service. It follows best practices by using an environment variable ($EACHLABS_API_KEY) for authentication rather than hardcoding credentials.

rembg