The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructions include curl commands that perform network requests to eachsense-agent.core.eachlabs.run. Additionally, documentation in references/SSE-EVENTS.md references media hosted on storage.eachlabs.ai. Both domains are legitimate infrastructure owned by the skill author, EachLabs.
[CREDENTIALS_UNSAFE]: Authentication for API requests is handled through the $EACHLABS_API_KEY environment variable. This demonstrates proper secret management by preventing the exposure of hardcoded API tokens in the skill files.
[INDIRECT_PROMPT_INJECTION]: The skill functions by ingesting user-provided text prompts and external image URLs to generate ad content, which represents an indirect prompt injection attack surface.
Ingestion points: User-supplied strings in the messages array and external URLs in the image_urls array within the API request payload.
Boundary markers: None are present in the provided command-line examples to delimit user input from system instructions.
Capability inventory: The skill facilitates network operations specifically limited to the EachLabs API endpoint.
Sanitization: No client-side sanitization is described; the skill relies on the safety guardrails implemented within the EachLabs AI models.

meta-ad-creative-generation