The Agent Skills Directory

[DATA_EXFILTRATION]: The skill allows for the reading and remote transmission of arbitrary local files without any directory restrictions. \n
Evidence: In media-understand.js, the --media argument is used directly as a file path in fs.existsSync(mediaPath), fs.statSync(mediaPath), and falUploadFile(mediaPath). This enables the skill to access any file reachable by the runtime and upload its contents to the remote FAL proxy, presenting a high risk of sensitive data exfiltration (e.g., .ssh/id_rsa, .env files, or AWS credentials) if an attacker-controlled prompt triggers the analysis of these paths.\n- [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted media data and interpolates user prompts into an LLM request without sufficient isolation or sanitization.\n
Ingestion points: The skill accepts external media via the --media parameter (local files or URLs) and a potentially malicious analysis prompt via --prompt.\n
Boundary markers: Absent. The message content for the LLM is constructed in buildOpenRouterContent by appending the prompt and media URL as separate parts of a payload array without delimiters or instructions to ignore embedded commands.\n
Capability inventory: The skill has the ability to read the local file system (fs), perform network uploads (falUploadFile), and interact with external AI providers (falRun).\n
Sanitization: No validation or filtering is applied to the media content or the user-supplied prompt before they are passed to the remote model for analysis.

media-understand