The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates the installation and update of official Kling AI CLI packages (@klingai/cli-cn and @klingai/cli-global) from the official NPM registry (registry.npmjs.org). These are documented vendor resources belonging to klingai-tech.
[CREDENTIALS_SAFE]: Authentication is handled via a standard OAuth flow (kling login) which stores tokens in a local directory (~/.kling/.credentials). The instructions explicitly forbid the agent from exposing these credentials to users, even upon request, and correctly identifies .env files as a safe practice for secret management.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data such as user-provided prompts and media from public URLs to generate AI content. This represents a standard indirect prompt injection attack surface.
Ingestion points: User-provided text prompts and external image/video URLs passed to generation commands.
Boundary markers: Commands use structured arguments (e.g., --model, --image, --prompt) to separate instructions from data.
Capability inventory: Executes shell commands via the 'kling' CLI, including file uploads and network requests to Kling AI endpoints.
Sanitization: The skill relies on the CLI and backend MCP service to validate parameters and sanitize inputs before processing.
[COMMAND_EXECUTION]: The skill uses a set of canonical CLI commands to interact with the Kling AI service. These commands are scoped to the intended functionality of the tool and do not include arbitrary command execution or system modification patterns.

kling-cli