The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external image files provided by the user, creating a surface for potential indirect prompt injection. A crafted image could attempt to exploit vulnerabilities in processing libraries or influence the agent's downstream behavior through its output.
Ingestion points: The imagePath argument processed in scripts/extract-colors.sh and scripts/extract-colors.js (found in SKILL.md).
Boundary markers: None present to distinguish untrusted image data from system instructions.
Capability inventory: Accesses the local filesystem to read image files via the get-pixels library (found in scripts/extract-colors.js).
Sanitization: The skill relies on third-party libraries for parsing and does not implement additional validation of the input data.
[EXTERNAL_DOWNLOADS]: The skill automatically fetches and installs necessary dependencies from the NPM registry during setup.
Evidence: The scripts/extract-colors.sh script executes npm install if the node_modules directory is missing.
Details: Downloads the extract-colors and get-pixels packages from the public NPM registry.
[COMMAND_EXECUTION]: The skill uses a shell script to invoke a Node.js process for image analysis.
Evidence: Execution of node with the script path and image argument in scripts/extract-colors.sh.

image-analysis