The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The 'SKILL.md' file contains a 'Forced Pre-validation' section that instructs the agent to ask users to provide their 'ACCESS_KEY_ID' and 'SECRET_ACCESS_KEY' directly in the chat interface if they are not detected. This encourages users to share sensitive secrets in plain text.
[DATA_EXFILTRATION]: The skill uses 'echo' commands in 'SKILL.md' to print the values of 'ACCESS_KEY_ID' and 'SECRET_ACCESS_KEY' to the standard output. This practice can lead to credentials being exposed in agent logs, session history, or the user interface.
[COMMAND_EXECUTION]: 'SKILL.md' includes instructions for the agent to execute shell commands for credential configuration ('export'), dependency installation ('pip install'), and directory setup ('mkdir').
[EXTERNAL_DOWNLOADS]: The 'scripts/beauty.py' script uses 'urllib.request.urlopen' to download content from arbitrary, user-provided URLs. Additionally, 'scripts/requirements.txt' specifies 'pandas==2.3.3' and 'pydantic==2.12.5', which are not available on the public PyPI registry, suggesting a potential supply chain risk or reliance on non-standard package sources.
[PROMPT_INJECTION]: The skill ingests untrusted data from external URLs and ZIP files in 'scripts/beauty.py', creating a surface for indirect prompt injection attacks. 1. Ingestion points: 'scripts/beauty.py' via the '--file' argument which accepts remote URLs and local file paths. 2. Boundary markers: The skill does not employ explicit delimiters to isolate external image or file data from the agent's instructions. 3. Capability inventory: The skill possesses network access ('requests', 'urllib') and file system access ('zipfile', 'tarfile', 'os'). 4. Sanitization: The 'extract_archive_file' function implements 'os.path.realpath' validation to prevent directory traversal attacks during decompression.

byted-kickart-ai-beauty