The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data which is then sent to an external API. This presents a surface for indirect prompt injection if the external service is vulnerable to malicious instructions embedded in the music prompts or lyrics.
Ingestion points: The prompt, lyrics, scene_description, and project_name parameters in scripts/trustee_api.py are populated from user input.
Boundary markers: There are no explicit delimiters or instructions to the backend API to ignore potentially malicious content within these fields.
Capability inventory: The skill possesses network capabilities via the requests library, allowing it to communicate with giggle.pro endpoints.
Sanitization: The script performs basic validation on Base64 image data but does not sanitize or escape the natural language strings (prompts/lyrics) before including them in the JSON payload.
[COMMAND_EXECUTION]: The skill instructions direct the agent to execute a local Python script (scripts/trustee_api.py) with arguments derived from user input. This is the intended delivery mechanism for the skill's functionality.
[EXTERNAL_DOWNLOADS]: The skill defines a dependency on the requests library in scripts/requirements.txt, which is a standard and well-known Python package for handling HTTP requests.

giggle-generation-aimv-30