The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill makes network requests to the vendor's API endpoint (ai-factory.frevana.com) to retrieve product data. These are legitimate operations for the skill's stated purpose.
[COMMAND_EXECUTION]: The skill uses a bash script to coordinate execution, involving common utilities like curl and python3. Commands are used appropriately for payload preparation, network communication, and response validation.
[CREDENTIALS_UNSAFE]: The skill handles authentication via a FREVANA_TOKEN environment variable or an explicit --token argument. It explicitly includes instructions not to echo the token back to the user and implements secure input (read -s) in interactive mode.
[DATA_EXFILTRATION]: No evidence of unauthorized data transmission was found. Network activity is limited to the defined vendor API, and local file writes are restricted to saving the API response JSON for user consumption.
[PROMPT_INJECTION]: The skill documentation clearly defines input requirements, instructing the agent to reject generic search terms and demand a specific token from prior search results, reducing the surface for injection via malformed user input.

google-immersive-product