The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/upload_image.py executes the PicGo CLI or a user-specified binary via the PICGO_BIN environment variable using the subprocess.run method to perform image uploads.
Evidence: The script constructs a command list starting with the binary path and arguments before passing it to subprocess.run.
[INDIRECT_PROMPT_INJECTION]: The skill processes Markdown files provided by the user, creating an attack surface for indirect prompt injection where malicious instructions could be embedded within the document content.
Ingestion points: Markdown content is read directly from local files in scripts/upload_image.py.
Boundary markers: No specific delimiters or safety warnings are used when interpolating file content into the agent's context.
Capability inventory: The skill has the ability to read and write to the local filesystem and perform network operations via PicGo or its verification routine.
Sanitization: The script uses regular expressions to extract image paths, distinguishing between local and remote references to minimize unintended processing.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to verify that the URLs returned by the PicGo backend are reachable and valid.
Evidence: The verify_url function in scripts/upload_image.py utilizes urllib.request.urlopen to make HTTP HEAD and GET (ranged) requests to external URLs generated during the upload process.

lov-upload-image