The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides shell examples using curl and Python blocks. These examples are for legitimate API interaction and follow security best practices, such as using environment variables for sensitive tokens and implementing strict timeouts.
[EXTERNAL_DOWNLOADS]: The skill documents interactions with the official API endpoint external.api.recraft.ai. The provided Python examples include robust safety checks for downloading generated assets, such as enforcing HTTPS, preventing unauthorized redirects, limiting download sizes to 50MiB, and verifying file magic numbers (PNG/SVG).
[DATA_EXFILTRATION]: The skill explicitly warns against sending the $RECRAFT_API_TOKEN to any host other than the official API endpoint. The provided code examples demonstrate downloading assets via a custom opener that does not forward the authorization header, preventing accidental credential exposure to CDNs or redirect targets.
[INDIRECT_PROMPT_INJECTION]: While the skill processes user-supplied prompts and images for an external AI model, it includes significant defensive logic to protect the agent's environment. Specifically, Example 2 provides a comprehensive SVG sanitizer using defusedxml and a strict allowlist of tags and attributes to prevent XSS, XXE, and data exfiltration through malicious vector content.

recraft-image-design