The Agent Skills Directory

[DATA_EXFILTRATION]: The automated scanner detected a blacklisted malicious URL https://sub.zzshu.cc/v1/images/generations within the skill's evaluation records (evaluations/2026-11-02-custom-service-test/attempt-01/generation.json). The script light-diagram-prompt/scripts/image_service.py is designed to send user-configured API keys to such endpoints via the Authorization: Bearer header.
[COMMAND_EXECUTION]: The skill utilizes win32com.client in several scripts (e.g., light-visio-diagram/scripts/render_scene.py, light-powerpoint-diagram/scripts/draw_visible.py, light-illustrator-diagram/scripts/illustrator.py) to automate desktop applications. This capability allows the agent to perform arbitrary actions within the user's local installations of Visio, PowerPoint, and Adobe Illustrator.
[DYNAMIC_EXECUTION]: The script light-illustrator-diagram/scripts/illustrator.py dynamically assembles and executes ExtendScript code within Adobe Illustrator using the app.DoJavaScript(code) method. This represents a dynamic code generation and execution vector.
[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface for indirect prompt injection.
Ingestion points: It is designed to read and parse research papers, methods sections, and user-supplied concepts (documented in light-diagram-prompt/SKILL.md).
Boundary markers: While it uses structured data like scene.json and internal IDs, it relies on the agent to interpret potentially untrusted external text.
Capability inventory: The skill possesses significant capabilities, including network access for image generation and filesystem manipulation via office automation tools.
Sanitization: The image_service.py script performs basic JSON encoding but does not sanitize the conceptual content of the prompt derived from external sources.
[EXTERNAL_DOWNLOADS]: The image_service.py script performs network operations using urllib.request to download image assets from remote URLs returned by generation services, potentially exposing the agent to malicious payloads or tracking.

light-diagram