The Agent Skills Directory

[SAFE]: The skill provides instructions for interacting with the Real-ESRGAN API via the Pixazo gateway. The network operations are limited to the vendor's own domain (pixazo.ai), which is consistent with the skill's purpose.
[CREDENTIALS_UNSAFE]: The skill manages an API key for the Pixazo service. It instructs the agent to store the key in ~/.pixazo/api-key and explicitly recommends using chmod 600 to restrict file permissions to the owner, which is a recognized security best practice for local secret management.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it processes external input.
Ingestion points: User-provided image URLs and text prompts are ingested in Step 3 and the 'Inputs' section.
Boundary markers: No explicit boundary markers or 'ignore' instructions are used when interpolating these inputs into API requests.
Capability inventory: The skill is capable of performing network POST requests using curl, Python requests, and Node.js fetch (SKILL.md).
Sanitization: There is no explicit sanitization logic described for the external image URLs or prompt strings before they are transmitted to the API.

real-esrgan