The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The script scripts/generate_image.js transmits a user-provided prompt and an API key to dashscope.aliyuncs.com. This is the official endpoint for Alibaba Cloud's DashScope service, and the skill follows standard security practices by sourcing the credential from the DASHSCOPE_API_KEY environment variable.\n- [EXTERNAL_DOWNLOADS]: The skill uses Node.js built-in http and https modules to fetch image data from URLs returned by the generation API. It saves these files to the local directory using timestamp-based filenames to prevent collisions.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes output from an external AI model to determine the source URL for image downloads, representing a potential injection surface.\n
Ingestion points: The script scripts/generate_image.js parses the JSON response body from the DashScope API to extract image locations.\n
Boundary markers: No explicit boundary markers or instruction-filtering logic is applied to the content returned by the remote model.\n
Capability inventory: The skill has the ability to perform network GET/POST requests and write files to the filesystem via the fs module.\n
Sanitization: The script validates the target using the URL constructor but does not implement a domain-specific allowlist for the downloaded content.

image-generation