The Agent Skills Directory

[SAFE]: The skill interfaces with the vendor's own API gateway (tool-gateway.linkfox.com) for AIGC tasks. All network operations in aigc_videogen_multi.py and onboarding.py target the developer's verified domains (linkfox.com).
[SAFE]: The onboarding script (onboarding.py) handles authentication and billing. While it accesses environment variables like LINKFOX_AGENT_API_KEY, it follows standard developer practices for CLI-based authentication and secret management without exfiltration to third parties.
[COMMAND_EXECUTION]: The skill uses urllib.request to perform POST requests to its own API. This is the primary function of the skill and is documented. No arbitrary command execution from untrusted input was detected.
[DATA_EXPOSURE]: The skill downloads generated media to a local media/ directory and logs metadata to a linkfox/ session folder. This is standard behavior for an agent skill to persist output for the user.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided imageList and prompt. Ingestion boundaries are maintained by passing these as structured JSON to the API. The SKILL.md includes explicit instructions for the agent to avoid reading the binary content of generated videos, reducing the surface for data-driven injection.

linkfox-aigc-videogen-multi