The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it interpolates user-supplied text from the --scene-prompt argument directly into the AI model's instructions without sanitization or boundary markers.
Ingestion points: The scene_prompt argument in SKILL.md and scripts/generate_scene.py processes untrusted user input.
Boundary markers: No delimiters or instructions to ignore embedded commands are present in the prompt template.
Capability inventory: The skill can perform network requests to the Volcano Engine API and write files to the local system.
Sanitization: No input validation or escaping is performed on the user-provided prompt.
[DATA_EXFILTRATION]: The skill includes a file transmission surface that allows it to read and send local files to a remote API.
Ingestion points: The --product-image argument allows specifying arbitrary file paths that the agent may be tricked into reading.
Capability inventory: scripts/generate_scene.py reads the file content, encodes it in Base64, and transmits it via an HTTP POST request to the official Volcano Engine API domain (ark.cn-beijing.volces.com).
Sanitization: There are no checks to verify that the file at the provided path is an image before it is read and transmitted externally.

product-scene-gen