The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The scripts/download-image.sh script programmatically retrieves a Salesforce accessToken using the sf org display command. While this is a standard Salesforce CLI operation, the script then handles this sensitive token in a way that risks exposure.
[DATA_EXFILTRATION]: The script uses curl to download an image from a URL passed as the --url argument. It includes the retrieved Salesforce accessToken in the Authorization: Bearer header. Because the --url argument originates from the output of the create_image tool, the script will transmit the credential to any URL provided by that tool. This creates a direct path for credential exfiltration if the tool response is malicious or manipulated.
[COMMAND_EXECUTION]: The skill executes a local shell script scripts/download-image.sh. This script performs network requests, directory creation, and executes other CLI tools (sf, jq, code).
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerable surface where untrusted data from an external tool (create_image) is directly processed by a script with high-privilege capabilities.
Ingestion points: The <image_url_from_response> and <responseId> are taken from the create_image tool output and passed as arguments to a bash script.
Boundary markers: None. The agent is instructed to pass the raw response values directly to the script.
Capability inventory: The skill can execute shell scripts, perform network operations (curl) with credentials, and run Salesforce CLI commands to retrieve tokens.
Sanitization: The download-image.sh script performs basic checks (ensuring the URL starts with https:// and the ID does not contain path traversal characters), but it does not validate the destination domain before sending the Salesforce access token.

experience-content-media-image-generate