The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The scripts/tag.py script uses numpy.load with allow_pickle=True when querying search indices. This function call allows for the execution of arbitrary code if the script is directed to load a maliciously crafted .npz file via the --index CLI argument.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It processes media files (images and videos) that may contain visual text or patterns designed to override model instructions. It also accepts user-provided prompts that are interpolated into conversation templates for models like LLaVA without sanitization.
Ingestion points: The --prompt CLI argument and media files (input images/videos) processed by scripts/tag.py.
Boundary markers: The script uses USER: and ASSISTANT: markers for LLaVA conversation templates, providing some structural separation but not a complete defense against adversarial prompts.
Capability inventory: The skill can read and write local files (text, CSV, JSONL, and serialized numpy arrays) but does not have access to arbitrary shell commands or unauthorized network destinations.
Sanitization: No validation or sanitization is performed on input prompts or the content of media files before they are passed to the vision-language models.
[EXTERNAL_DOWNLOADS]: The skill downloads model weights and configuration files from HuggingFace Hub using standard libraries. These downloads occur during the initial setup or first use of a model and target a well-known and trusted service provider.

media-tag