The Agent Skills Directory

[DATA_EXFILTRATION]: The skill transmits the full content of user-provided files, encoded as Base64, to a network endpoint defined by the WATERMARKS_SERVICE_URL environment variable. While the default is set to a local loopback address (127.0.0.1), the mechanism allows sending data to any remote server if the variable is modified.
Evidence: SKILL.md contains the command template: curl -s -X POST "${AUTH_HEADER[@]}" "$WM/clean" -H 'Content-Type: application/json' -d "{\"file\": \"$(base64 < notes.md | tr -d '\n')\", \"name\": \"notes.md\"}".
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from user-provided files and sends it to an external service, then decodes and writes the response back to the local filesystem. This creates a surface for indirect prompt injection where malicious content within the files could influence the agent's actions or result in the creation of malicious files locally.
Ingestion points: User-provided files in various formats (PNG, JPEG, PDF, DOCX, TXT, etc.) as described in the Workflow section of SKILL.md.
Boundary markers: No specific boundary markers or "ignore embedded instructions" warnings are used when processing the file content.
Capability inventory: The skill utilizes curl for network operations, base64 for encoding/decoding, and standard file read/write operations.
Sanitization: No evidence of sanitization or validation of the external content before processing or after receiving it from the service.
[COMMAND_EXECUTION]: The documentation instructs the agent to execute complex shell commands using curl, base64, and docker. The Docker recommendation specifically involves mounting host directories as volumes, which is a high-privilege operation that requires careful oversight.
Evidence: SKILL.md suggests: docker run --rm -v "$(pwd)/src:/data:ro" watermarks-remover /app/scripts/audit_dir.py /data --json.

remove-ai-marks