The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documentation states that it auto-installs c2pa-python and cryptography via pip install on its first run. This behavior introduces a runtime dependency on external package registries.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the user, specifically prompts and brand metadata, to embed them into the manifest of generated assets. This presents a surface for indirect injection where malicious instructions could be persisted within file metadata.
Ingestion points: CLI arguments such as --brand, --generator, --prompt, and --reviewer in SKILL.md.
Boundary markers: Absent; the documentation does not specify the use of delimiters or warnings to prevent the agent from interpreting instructions embedded in these metadata fields.
Capability inventory: The skill possesses file-write capabilities (--output) and executes a local script (scripts/embed-c2pa.py).
Sanitization: Absent; there is no mention of sanitizing or escaping the input metadata before it is processed by the underlying Python script.
[COMMAND_EXECUTION]: The skill operates by wrapping and executing a local Python script (scripts/embed-c2pa.py) with arguments derived from user input. This pattern carries a risk of command injection if the arguments are not properly sanitized or escaped before being passed to the shell environment.

c2pa-metadata