The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill references and attempts to access a sensitive local environment file at a hardcoded user-specific path: /Users/elihuvillaraus/Docs/SaaS/ai-content-machine/marcus/frontend/.env.local. This file is expected to contain KIE_API_KEY and KIE_API_BASE_URL.
[COMMAND_EXECUTION]: The skill performs shell command execution, including sourcing local files (source .env.local), running ffmpeg for frame extraction, and executing inline python3 scripts to parse JSON results from API calls.
[EXTERNAL_DOWNLOADS]: The skill downloads arbitrary HTML content from user-provided URLs using curl and makes requests to external API endpoints at api.kie.ai and litterbox.catbox.moe.
[DATA_EXFILTRATION]: The skill uploads locally generated image assets to litterbox.catbox.moe, a public file-sharing service, to provide a URL for secondary API processing. This may expose internal assets to the public web.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions.
Ingestion points: Raw HTML is ingested from a user-supplied URL during Phase 1 using curl.
Boundary markers: Absent. The skill does not define delimiters or specific instructions to the agent to disregard instructions found within the downloaded content.
Capability inventory: The skill possesses capabilities for network operations (curl), file system manipulation (mkdir, curl -o), and package management (pnpm).
Sanitization: No sanitization or content filtering is implemented for the ingested HTML data before extraction of brand information.

cinematic-marcus