The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides explicit instructions for the agent to use shell commands, specifically curl and wc, to handle the upload of local files to the vendor's platform.
[INDIRECT_PROMPT_INJECTION]: As the skill processes untrusted user data (images, video scripts, and prompts) to generate media, it is vulnerable to indirect injection attacks. \n
Ingestion points: User-provided images via upload_image and open_upload_panel, as well as user-supplied text for scripts and prompts. \n
Boundary markers: The skill includes instructions to ignore external image metadata like filenames or email domains, which acts as a partial boundary. \n
Capability inventory: The skill has access to file reading, network communication for status polling, and complex media generation tools. \n
Sanitization: No specific input sanitization or filtering logic for user-provided prompts is documented.
[DATA_EXFILTRATION]: The skill facilitates the transfer of local files to the external domain agent-media.ai. While this is the intended functionality of the media toolbox, it enables the movement of local data to external vendor-controlled infrastructure.

agent-media