The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/generate_thumbnail.py utilizes subprocess.run to invoke curl for file uploads. It correctly implements security best practices by passing the Authorization header via stdin (using --config -), which prevents sensitive API keys from appearing in the system's process list.
[CREDENTIALS_UNSAFE]: The skill requires a KIE_API_KEY. It correctly manages this by instructing the user to use an .env file. The helper script specifically filters for this key when loading the environment, preventing the inadvertent loading of unrelated sensitive variables.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of competitor thumbnail URLs and images. This risk is effectively mitigated by two design choices: first, the agent is required to manually describe the image contents (Step 3), and second, the skill mandates a human-in-the-loop approval of the final generated prompt (Step 5) before sending it to the generation models.
[EXTERNAL_DOWNLOADS]: The skill downloads competitor thumbnails from YouTube (i.ytimg.com) and interacts with KIE.ai (api.kie.ai, kieai.redpandaai.co). These are well-known services necessary for the skill's stated purpose of thumbnail analysis and generation.

thumbnail