The Agent Skills Directory

[DATA_EXFILTRATION]: The skill uses a command s3-stage to upload local files to an external S3 bucket (mcp-staging). While this is part of the intended workflow to allow the AI to process local images, it creates a significant data exposure risk. An attacker could potentially trick the agent into uploading sensitive files (e.g., .ssh/id_rsa, .env) by providing them as inputs to the image transformation process.
[COMMAND_EXECUTION]: The instructions direct the agent to execute several shell commands, including mkdir -p for directory creation and curl -sSL -o for downloading generated images. While these are used for legitimate functionality, they represent a broader attack surface if the agent is manipulated into executing arbitrary commands through the shell.
[PROMPT_INJECTION]: This skill is vulnerable to indirect prompt injection as it processes user-provided descriptive prompts and file paths. Maliciously crafted input could be used to override the skill's logic or influence the agent's subsequent actions.
Ingestion points: User-provided text prompts and local image file paths enter the agent context.
Boundary markers: No explicit boundary markers or instructions to ignore embedded content are used when interpolating user prompts into MCP tool calls.
Capability inventory: The skill utilizes mkdir, curl for network downloads, and s3-stage for network uploads.
Sanitization: There is no evidence of sanitization or validation performed on the user-provided prompts or file paths before they are used in shell commands or tool invocations.

ai-graphics