The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches generated images from remote CDN URLs. It implements strict host allowlisting and DNS-based SSRF protection to ensure images are only retrieved from approved, global infrastructure.\n- [COMMAND_EXECUTION]: The Python script executes an external security scanner using subprocess.run. This is implemented as a security feature, with the command provided via a controlled environment variable.\n- [INDIRECT_PROMPT_INJECTION]: The skill handles user prompts and external images. It mitigates injection risks through prompt length limits, image magic-byte/MIME verification, pixel caps, and mandatory human approval for execution.\n- [DYNAMIC_EXECUTION]: The script dynamically parses and executes a command list for security scanning. It validates the input structure from environment variables to prevent command injection.

leonardo-image