The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions and examples demonstrate a pattern of interpolating untrusted user data (like the video prompt) directly into a shell command string (belt app run ... --input '{...}'). This creates a vulnerability to command injection if the agent executing these instructions does not adequately sanitize or escape shell metacharacters in the user's input.
Ingestion points: Untrusted data enters via the prompt, image, reference_images, reference_videos, and reference_audios parameters defined in SKILL.md.
Boundary markers: The examples use single quotes to wrap the shell command argument and double quotes for the internal JSON structure, which is insufficient to prevent escaping under adversarial conditions.
Capability inventory: The skill is configured to use the Bash tool to execute belt CLI commands.
Sanitization: The skill lacks any instructions or mechanisms to sanitize, validate, or escape the external content before interpolation.
[EXTERNAL_DOWNLOADS]: The skill references and encourages the installation of code and configurations from external, non-whitelisted sources.
Evidence: The documentation directs users to install the belt-sh/cli skill and several inference-sh/skills packages using npx skills add.
Evidence: The skill references external content located at https://raw.githubusercontent.com/inference-sh/skills/refs/heads/main/cli-install.md for installation guidance.

seedance