The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes shell commands to manage configuration and perform network requests.
It resolves API keys by checking the $OATDA_API_KEY environment variable and the local configuration file at ~/.oatda/credentials.json using cat and jq.
It uses curl to transmit data to the vendor's API endpoint (https://oatda.com/api/v1/llm/image).
[DATA_EXFILTRATION]: The skill reads a local credential and sends it to an external domain.
The API key is read from the local file system and sent in the Authorization header to oatda.com.
This behavior is consistent with the skill's stated purpose of authenticating with the OATDA service.
[PROMPT_INJECTION]: The skill processes untrusted external data in the form of user prompts and image URLs.
It acts as an ingestion point for external content which represents an indirect prompt injection surface.
Notably, the skill includes explicit security instructions to mitigate SSRF (Server-Side Request Forgery) by instructing the agent to reject non-HTTPS URLs, local file paths, and internal IP addresses (localhost, loopback, and metadata service ranges).

oatda-vision-analysis