The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script in media-understand.js reads files from a user-provided path via process.argv[2] and transmits the content to a remote API. While the script implements a file extension check (e.g., .jpg, .png, .mp3), this validation is insufficient as it only checks the end of the filename using path.extname. An attacker could rename sensitive files, such as ~/.ssh/id_rsa to id_rsa.jpg, bypassing the filter. The script then executes fs.readFileSync(MEDIA_PATH) and base64 encodes the data to be sent to the external provider, resulting in potential sensitive data exposure.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted media data which acts as a vector for malicious instructions targeting the AI model.
Ingestion points: Media files or YouTube URLs provided as the first argument in media-understand.js.
Boundary markers: None. The user prompt and the media data are concatenated in the messages array sent to the API without delimiters or instructions to ignore embedded commands.
Capability inventory: The script possesses file system read access (fs.readFileSync) and network capabilities via fetch to send data to the internal.infquest.com endpoint.
Sanitization: No sanitization or filtering is performed on the content extracted from the media (e.g., OCR text from images or transcribed audio).

media-understand