The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides a command to download and execute an installation script directly from the vendor's domain: curl -fsSL https://picsart.com/gen-ai-cli/install.sh | bash. This is a legitimate installer for the skill's required CLI tool, hosted on Picsart's official infrastructure.
[EXTERNAL_DOWNLOADS]: The skill fetches the gen-ai CLI and associated model metadata from the picsart.com domain. These are official resources provided by the skill author.
[COMMAND_EXECUTION]: The skill relies on executing various shell commands via the gen-ai CLI, including functions for image generation, batch processing, and pricing estimation. These commands are integral to the skill's intended functionality.
[PROMPT_INJECTION]: The skill ingests user-provided text prompts that are passed to generative models, which constitutes a potential surface for indirect prompt injection.
Ingestion points: User-supplied strings used with the -p or --prompt flags in CLI commands (e.g., in SKILL.md and references/modes/variants.md).
Boundary markers: The instructions do not specify any delimiters or safety markers for separating user-supplied prompts from system instructions.
Capability inventory: The skill uses the gen-ai CLI tool, which has the capability to write to the local filesystem and interact with remote Picsart APIs.
Sanitization: There are no documented steps for the agent to sanitize or validate user-provided strings before they are executed in the CLI environment.

product-photo-studio