The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The configuration file config/default.json contains a hardcoded API key (sk-ghkgkwxvtjqnqiyrmhllqyhfpibkloycpbneuccpombdewzo). Hardcoding credentials in skill files is unsafe practice as it exposes secrets to anyone with access to the skill code.
[DATA_EXFILTRATION]: The scripts scripts/analyze_image.py and scripts/recognize.py read local image files, convert them to Base64, and transmit the data to external endpoints including https://api.siliconflow.cn/v1 and https://api.openai.com/v1. While this is the intended functionality, users should be aware that local data is being sent to third-party cloud services.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data (external images and user-supplied questions) and passes them to a vision model without sufficient sanitization.
Ingestion points: scripts/analyze_image.py accepts image paths/URLs and arbitrary text via the -q parameter.
Boundary markers: Missing. No specific instructions are provided to the vision model to ignore instructions embedded within the images themselves.
Capability inventory: The script has the capability to read local files and perform network operations via requests or urllib.
Sanitization: None. User input from CLI arguments is interpolated directly into the API request payload.

siliconflow-vision