The Agent Skills Directory

[SAFE]: The skill consists entirely of instructional markdown documentation. It contains no shell commands, scripts, or binary executables that would pose a security risk.
[CREDENTIALS_UNSAFE]: The skill correctly instructs the user to manage API credentials via the XAI_API_KEY environment variable. There are no hardcoded secrets or insecure credential handling patterns detected.
[EXTERNAL_DOWNLOADS]: The skill references official xAI API endpoints (api.x.ai). These are well-known service domains and are used purely for documentation of API integration.
[INDIRECT_PROMPT_INJECTION]: While the skill describes processing image URLs and base64 data, it functions as a guide rather than an implementation that would be vulnerable to adversarial data. The potential attack surface is minimal and handled by the provider's API guardrails.

grok-media