The Agent Skills Directory

[DATA_EXFILTRATION]: The script scripts/review-image.ts reads local files using Deno.readFile and transmits the content to a network endpoint via fetch. While the default destination is the well-known service OpenRouter, the script includes an --api-url parameter that allows overriding the target URL. This enables a potential data exfiltration path if an agent is tricked into reviewing sensitive files and redirecting the output to an attacker-controlled server.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted images and user-provided prompts, feeding them to a vision model whose output is returned to the agent context. This creates a vulnerability where malicious instructions embedded in an image could influence the agent's behavior.
Ingestion points: The skill accepts an image (via path or URL) and a text prompt as command-line arguments in scripts/review-image.ts and scripts/review-image-ci.ts.
Boundary markers: The instructions are sent within a structured message array to the model; however, there are no specific markers or warnings to the vision model to ignore instructions contained within the image itself.
Capability inventory: The skill possesses file read capabilities (--allow-read) and network access (--allow-net).
Sanitization: There is no evidence of sanitization or filtering of the image data or the prompt text before it is sent to the external vision model.

review-image