The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill connects to the ByteDance Volcengine (Doubao) API at ark.cn-beijing.volces.com to generate visual content. It subsequently downloads the generated images via HTTP GET requests for local processing and cropping. As this targets a well-known service for the skill's primary function, it is considered safe.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided strings for titles and subtitles which are then interpolated into image templates and filenames. While this creates a surface for indirect injection, the risk is minimal given the visual rendering context.
Ingestion points: User-provided title and subtitle variables in cover_generator.py and handler.py.
Boundary markers: The skill does not implement specific boundary markers or delimiters for the injected text within its template engine.
Capability inventory: The skill has capabilities to write to the local output/ directory and specified project assets/images/ folders, and performs network requests to the image generation API.
Sanitization: The skill performs standard filename sanitization via the sanitize_filename function to ensure generated files are compatible with the local filesystem, though no specific sanitization is applied to the text rendered on the images.

visual-creator