The Agent Skills Directory

[DATA_EXFILTRATION]: The skill communicates exclusively with the official iFlytek Spark API endpoint (spark-api.cn-huabei-1.xf-yun.com) to perform its stated function of text-to-image generation. No unauthorized data transmission was detected.
[CREDENTIALS_UNSAFE]: The script properly handles sensitive information by requiring XFYUN_APP_ID, XFYUN_API_KEY, and XFYUN_API_SECRET to be provided as environment variables. No credentials are hardcoded in the source code.
[PROMPT_INJECTION]: The script ingests user-provided text through the --prompt argument. While the input is interpolated directly into the JSON request body for the API, the script implements a 1000-character length constraint as a basic sanitization measure. The risk is limited to the context of the image generation model's output.

xfyun-tti