The Agent Skills Directory

[SAFE]: The skill uses local Node.js scripts (scripts/generate.mjs) for all operations, which are strictly scoped to the skill's intended functionality.
[SAFE]: All external downloads of generation results are handled through a safeUrl validation function that ensures URLs use HTTPS and do not contain embedded credentials.
[SAFE]: Sensitive information is protected by managing the IFUTURE_API_KEY via environment variables, with explicit instructions to the agent to avoid leaking it and code logic that masks the key in error reports.
[SAFE]: The skill follows a no-dependency approach, using only Node.js 24 native modules (fetch, crypto, streams), which minimizes supply chain risks.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from local files and API responses as part of its core functionality.
Ingestion points: Reads user-provided prompt.txt, parameters.json, and external API responses like models.json and files.json.
Boundary markers: Uses structured JSON for data exchange; no specific delimiters for LLM instructions are defined within the processed data.
Capability inventory: The skill has the capability to perform network requests (fetch) and file operations (read/write) via the scripts/client.mjs and scripts/generate.mjs scripts.
Sanitization: Implements robust API key masking to prevent credential leakage in error messages and performs URL protocol validation on all remote assets.

ifuture-generation