The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied strings via the --prompt, --negative-prompt, and --extra-json arguments which are passed to the Hugging Face Inference API.
Ingestion points: Untrusted data enters the context through command-line arguments in scripts/hf_generate.py.
Boundary markers: Prompts are not wrapped in delimiters or accompanied by warnings to ignore embedded instructions before being sent to the API.
Capability inventory: The skill has the ability to write files to the local system (saving images/videos) and perform network operations via the huggingface_hub library.
Sanitization: The script performs basic JSON validation on the extra-json input to ensure it is a dictionary, but does not sanitize the content of the prompts themselves.
[COMMAND_EXECUTION]: The skill operates by instructing the agent to execute a local Python script with arguments derived from user input.
The implementation uses the argparse library to handle inputs safely and does not use dangerous functions like eval() or subprocess.run() for internal logic.

hf-inference