The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script search-image.py contains a hardcoded secret key in the APP_KEY variable used for generating MD5 authentication signatures.
[DATA_EXFILTRATION]: The skill performs network requests to an external API endpoint (https://autoglm-api.zhipuai.cn/agentdr/v1/assistant/skills/search-image) to retrieve image data.
[DATA_EXFILTRATION]: The script attempts to connect to a local service at http://127.0.0.1:53699/get_token to retrieve authentication tokens, creating a dependency on the local environment.
[PROMPT_INJECTION]: The skill processes untrusted data from an external API response and instructs the agent to render it as Markdown, creating a potential surface for indirect prompt injection.
Ingestion points: Data returned from the autoglm-api.zhipuai.cn endpoint in the results array.
Boundary markers: None; the script and instructions do not use delimiters or instructions to ignore embedded content.
Capability inventory: The script uses urllib.request for network communication.
Sanitization: No sanitization or validation is performed on the original_url or caption fields before they are displayed to the user.

autoglm-search-image