The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses Python's urllib to make HTTP requests to the platform's API. While the instructions suggest executing scripts via python3 {baseDir}/scripts/..., these are part of the skill's own distribution and perform legitimate integration tasks.
[EXTERNAL_DOWNLOADS]: The download_results.py script downloads generated media files from URLs provided by the API. It uses urllib.request.urlopen with a standard User-Agent. These downloads are triggered by the user's generation requests.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided messages and external API responses (status updates). It explicitly instructs the agent to act as a "transporter" and avoid modifying or interpreting the prompts locally, which reduces the risk of the agent being manipulated by malicious instructions embedded in data, though a surface for indirect injection exists when the agent displays API results to the user.

xyq-nest-skill