The Agent Skills Directory

[SAFE]: The skill provides instructional content and code templates for interacting with official OpenAI API endpoints. All network activity is directed toward well-known domains (api.openai.com).
[DATA_EXPOSURE]: Several templates (e.g., audio-transcription.ts, image-editing.ts) use the fs module to read local files for the purpose of uploading them to the OpenAI API. This is the intended primary function of the skill for processing local media assets.
[COMMAND_EXECUTION]: The skill includes a utility script scripts/check-versions.sh which uses standard shell commands (npm list, npm view, awk, sed) to verify package versions. This is a common development practice and presents no security risk.
[INDIRECT_PROMPT_INJECTION]: The skill provides an interface for processing untrusted external data (such as user-provided messages and external image URLs). While this creates an inherent attack surface for indirect prompt injection, the documentation includes mitigation strategies such as using structured outputs and system instructions to guide model behavior.

openai-api