The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes various mediaio CLI commands (e.g., generate create, upload create, account status) to perform its primary function. It incorporates mandatory security checkpoints requiring the agent to obtain host-native approval before launching networked processes or accessing files outside the workspace.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prompts and media files for generation. This represents an indirect prompt injection surface; however, the risk is mitigated by the skill's explicit instructions to monitor server-side safety status codes (NSFW/IP detection) and its reliance on a controlled CLI environment.
Ingestion points: User-provided text prompts and source media uploaded via mediaio upload create.
Boundary markers: Not explicitly required for inputs, but output handling uses temporary directories and type verification.
Capability inventory: Shell command execution for the mediaio CLI, file system reads for source media, and file system writes for results.
Sanitization: Relies on server-side content policy filtering, as documented in troubleshooting.md (e.g., content_sensitive, text_sensitive labels).
[SAFE]: The skill follows vendor best practices by using official Media.io endpoints (vapi.media.io) and identifiers. It explicitly forbids the agent from silently installing the CLI, requiring instead that the user manage the shared runtime installation.

mediaio-generate