The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/analyze.sh executes shell commands, specifically curl and jq, to interact with the fal.ai API. It manages sensitive configuration by sourcing .env files and providing a helper flag --add-fal-key to write the FAL_KEY to a local .env file.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8).
Ingestion points: Untrusted data enters the agent context through the --image-url and --query arguments in scripts/analyze.sh.
Boundary markers: None are present; the inputs are directly interpolated into the JSON payload sent to the remote API.
Capability inventory: The script performs network operations (curl) and local file writes (writing to .env via --add-fal-key).
Sanitization: There is no validation or sanitization of the IMAGE_URL or QUERY variables before they are used in the curl command's JSON payload, which could lead to malformed JSON or unexpected API behavior if the input contains quotes or control characters.

fal-vision