The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it incorporates untrusted inputs into model prompts without sanitization or protective boundary markers.
Ingestion points: The image (base64 or path) and question arguments in the scripts/image_understanding.py script.
Boundary markers: Absent. The script concatenates input strings directly into the API request's message content.
Capability inventory: The skill executes scripts/image_understanding.py, which has network access to the Doubao API endpoint.
Sanitization: No validation or sanitization is performed on user-supplied text or image content before it is processed.
[DATA_EXFILTRATION]: The script scripts/image_understanding.py includes functionality that can read any local file that the executing environment has permission to access.
Evidence: Lines 212-225 in scripts/image_understanding.py attempt to resolve the provided image argument as a local file path if it is not already a data URI. It reads the file content, encodes it, and transmits it to the external Doubao API endpoint. While this facilitates processing local image files, it could be leveraged to expose sensitive system data if the agent is manipulated into passing unintended file paths.
[SAFE]: The skill transmits data to the official Doubao API endpoint (ark.cn-beijing.volces.com), which is a recognized and well-known service.

image-understanding