The Agent Skills Directory

[DATA_EXFILTRATION]: The VisionManager._encode_image method in scripts/vision_manager.py reads local files based on paths provided to the tool's arguments. The file content is Base64 encoded and transmitted to external vision API endpoints (Zhipu or Alibaba Qwen) via HTTP POST. The implementation lacks restrictions on the file system paths, meaning it could be used to read and exfiltrate sensitive files such as SSH keys, environment variables, or configuration files if the agent is instructed to analyze them.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted media from external URLs or local files, which are then passed to a vision model.
Ingestion points: Media is ingested via the --image, --video, and --file flags in scripts/vision.py.
Boundary markers: No boundary markers or "ignore" instructions are present to delimit the untrusted media content from the agent's instructions.
Capability inventory: The skill possesses the capability to read arbitrary local files and perform network operations (HTTP POST) to external services.
Sanitization: No validation or sanitization of the processed media or file content is implemented before it is sent to the LLM backend.

image-analysis