The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides a Python implementation that uses subprocess.run to invoke an external image scanner. This execution is securely handled by defining the scanner command through a controlled environment variable (LEONARDO_IMAGE_SCAN_COMMAND_JSON) and passing local file paths, facilitating pluggable security validation for downloaded media.
[EXTERNAL_DOWNLOADS]: The skill facilitates downloading images from Leonardo.Ai's infrastructure and uploading data to presigned storage URLs. The provided code implements industry-standard security controls, including host suffix allowlisting and DNS resolution checks (via socket.getaddrinfo and ipaddress.is_global) to prevent Server-Side Request Forgery (SSRF) and access to private network resources.
[PROMPT_INJECTION]: As the skill ingests content from a third-party API (Leonardo.Ai), it acknowledges the theoretical risk of indirect prompt injection. This surface is mitigated through explicit instructions for data sanitization and a Python implementation that performs deep integrity verification on all ingested artifacts, including magic byte validation, pixel count limits, and full image decodes before use.

leonardo-image