The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input that is subsequently sent to the each::labs API, creating a potential vector for indirect prompt injection.
Ingestion points: The skill ingests user-provided 'content' strings and 'image_url' objects within the messages array as seen in the SKILL.md examples.
Boundary markers: The skill lacks explicit boundary markers or delimiters to separate user-provided content from the intended instruction format in the API payload.
Capability inventory: The skill leverages Bash(curl *) and WebFetch to interact with the each::labs backend infrastructure.
Sanitization: No sanitization, validation, or escaping of user input is implemented before the data is included in the request to the remote service.
[COMMAND_EXECUTION]: The skill uses the Bash(curl *) tool to perform API requests. These commands are limited to the intended functionality of interfacing with the eachlabs.run endpoint and use environment variable placeholders for API keys, which is a secure method for handling credentials.

song-generation