The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a workflow that accepts user-provided text prompts and image URLs for processing by an external API. This constitutes a standard injection surface for generative AI tools.
Ingestion points: prompt and input_image parameters in request payloads within SKILL.md, python-client.py, and typescript-client.ts.
Boundary markers: The skill does not explicitly use delimiters for prompts, relying on the API provider's internal safety controls.
Capability inventory: Includes shell command execution (cURL), network operations (requests, fetch, aiohttp, axios), and local file system writes for image downloads.
Sanitization: Validates image dimensions (multiples of 16, 4MP limit) and exposes the API's safety_tolerance parameter.
[SAFE]: Secret management instructions recommend industry-standard practices, such as utilizing environment variables and .env files combined with .gitignore to prevent accidental credential leakage.
[SAFE]: The webhook implementation guides prioritize security by providing code examples for HMAC-SHA256 signature verification using hmac.compare_digest in Python and crypto.timingSafeEqual in TypeScript.
[SAFE]: Network operations are directed towards legitimate API endpoints (api.bfl.ai) and reputable cloud infrastructure (bfldeliveryprod.blob.core.windows.net) for asset delivery.

bfl-api