The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions explicitly direct the agent to print the values of sensitive environment variables ACCESS_KEY_ID and SECRET_ACCESS_KEY to the chat console during the authentication check phase, exposing them in the session history.
[CREDENTIALS_UNSAFE]: The skill provides a fallback mechanism that asks users to paste their cloud authentication keys directly into the chat in plain text if they are not detected in the environment.
[REMOTE_CODE_EXECUTION]: The skill implements an update logic where it queries a remote API (icp.volcengineapi.com) for version information and executes a command string (install_command) returned by the server if the user agrees to update.
[EXTERNAL_DOWNLOADS]: The skill downloads image files from arbitrary public URLs provided by the user using curl and the Python requests library for processing.
[COMMAND_EXECUTION]: The skill executes the unzip command on user-provided ZIP files, which can lead to security vulnerabilities if the archives are malformed or contain malicious paths.
[EXTERNAL_DOWNLOADS]: The skill downloads and installs various Python dependencies from a requirements file using pip during its initialization process.

byted-kickart-saliency-segmenter