The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads generated images and audio files from Alibaba Cloud's DashScope API (dashscope.aliyuncs.com) and Zhipu AI's API (open.bigmodel.cn). These are official endpoints for well-known technology services.
[COMMAND_EXECUTION]: Documentation includes examples of using curl to interact with REST APIs and base64 to process audio files for voice cloning tasks.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes external inputs (text prompts and image URLs) that are then passed to external AI models.
Ingestion points: Processes user-provided prompt, text, and image_url fields across SKILL.md and reference files.
Boundary markers: No explicit delimiters or boundary markers are used in the prompt construction logic shown in the documented snippets.
Capability inventory: Writing downloaded media files to the local file system using open() calls in Python code examples.
Sanitization: Relies on the external API provider's internal safety filters.
[DATA_EXPOSURE]: The skill handles local file paths such as /tmp/ and /home/ubuntu/hermes/cache/ for storing temporary media assets. It correctly recommends using .env files for managing API keys, which is a standard security best practice.

dashscope