The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly requests permission to read sensitive configuration and credential files at ~/.meitu/credentials.json and ~/.meitu/tool-registry.json. While these appear to be vendor-specific files for the Meitu service, accessing local credential stores is a sensitive operation.
[EXTERNAL_DOWNLOADS]: The instructions suggest downloading and installing the meitu-cli package from the official NPM registry (npm install -g meitu-cli@latest) if the dependency is missing or outdated. NPM is a well-known service, and the package is a vendor-owned resource.
[COMMAND_EXECUTION]: The core functionality relies on executing the meitu command-line tool with various arguments, including file paths and user-provided strings.
[INDIRECT_PROMPT_INJECTION]: The skill defines a shell command template that interpolates the user-provided prompt directly into the --prompt argument: meitu image-edit ... --prompt "<edit_description>". This pattern creates a command injection surface if the user-supplied text contains shell metacharacters (like backticks or subshell syntax) that are not properly sanitized or escaped before execution.
Ingestion points: The prompt and image_list parameters are derived from user input and external data.
Capability inventory: The skill uses exec permissions for the meitu CLI and file_write permissions to save results.
Boundary markers: The prompt is wrapped in double quotes in the command template, which provides minimal protection against sophisticated shell injection.
Sanitization: The instructions do not specify any validation, escaping, or sanitization requirements for the user-provided prompt before it is passed to the shell.

image-edit