The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The script communicates with Vercel's official Blob storage API at blob.vercel-storage.com to perform file uploads. Vercel is a well-known and trusted technology service provider.
[COMMAND_EXECUTION]: Executes a local Node.js script (upload.mjs) to handle the logic for reading files and sending them to the remote API. This is the intended behavior of the skill.
[CREDENTIALS_UNSAFE]: Handles a sensitive authentication token (BLOB_READ_WRITE_TOKEN) via environment variables. The documentation provides secure guidance by suggesting the use of a secret management tool (Infisical) rather than hardcoding credentials, and it explicitly instructs the agent never to log the token.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because it reads file paths provided as input.
Ingestion points: File paths passed via command line arguments in scripts/upload.mjs.
Boundary markers: Absent; the skill does not verify if the file path points to an intended image versus a sensitive system file.
Capability inventory: File reading via fs.readFileSync and network transmission via fetch in scripts/upload.mjs.
Sanitization: Basic extension-based MIME type detection is performed, but no validation of file content or path restriction is enforced beyond existence checks.

upload-photo