The Agent Skills Directory

[DATA_EXPOSURE]: The skill provides strict, proactive instructions to prevent the leakage of sensitive API keys. It explicitly forbids commands that could output environment variables or headers to logs or the terminal, such as env, printenv, or echo $VAR, and mandates that keys only be used within request headers.
[COMMAND_EXECUTION]: The skill defines safe templates for interacting with provider APIs and CLIs. It emphasizes security best practices, such as using absolute paths and avoiding verbose output flags (-v, --trace) to ensure no sensitive metadata or authentication headers are exposed during execution.
[INDIRECT_PROMPT_INJECTION]: As the skill handles untrusted data in the form of user-provided generation prompts, it implements a robust defense-in-depth strategy. It requires the agent to write prompts to temporary files using quoted Heredocs (<<'EOF') to prevent shell expansion and use jq for JSON construction, effectively neutralizing command injection attacks originating from processed data.
[DYNAMIC_EXECUTION]: The skill generates shell commands at runtime to interact with external services. This behavior is well-documented and follows a restricted template designed to handle dynamic parameters (like model names and prompts) securely without exposing the execution environment to arbitrary command injection.
[EXTERNAL_DOWNLOADS]: The skill facilitates communication with official API endpoints for well-known services including Higgsfield, Magnific, and OpenAI. These interactions are restricted to the primary purpose of the skill—media generation and processing—and follow established security protocols for each platform.

proveedores