The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs and executes shell commands by interpolating user-provided text directly into arguments. This pattern is vulnerable to shell command injection if the input contains characters like backticks, semicolons, or pipes.
Evidence: The Execute section in SKILL.md uses --prompt "{page_description}" inside backticks and bash command templates.
[EXTERNAL_DOWNLOADS]: The skill documentation instructs the agent to download and install an external package from the NPM registry if the tool is missing from the system.
Evidence: The Preflight section in SKILL.md contains the command npm install -g meitu-cli@latest.
[DATA_EXFILTRATION]: The skill is configured to read sensitive files from the user's home directory that contain authentication credentials for the Meitu OpenAPI.
Evidence: The metadata and requirements sections in SKILL.md explicitly request file_read permissions for ~/.meitu/credentials.json.
[PROMPT_INJECTION]: The skill processes untrusted user descriptions and external media URLs which are passed as context to a remote code generation API, creating an attack surface for indirect prompt injection.
Ingestion points: The prompt, image_list, and video_list parameters in SKILL.md.
Boundary markers: None identified in the prompt templates.
Capability inventory: Execution of meitu CLI and file writing to local directories.
Sanitization: No explicit sanitization or validation of the input content is described.

text-code