The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text descriptions (text_prompt) and file metadata which are processed by the AI video model. This represents a surface for indirect prompt injection where malicious instructions could be embedded in the input data.
Ingestion points: SKILL.md identifies text_prompt, input_image, and input_video as inputs.
Boundary markers: Absent; inputs are interpolated into JSON payloads without explicit delimiters or safety instructions.
Capability inventory: The skill utilizes shell execution, network operations via the refly CLI (upload/run/download), and file system access to the user's Desktop.
Sanitization: No sanitization logic is present to filter or escape the input content before execution.
[COMMAND_EXECUTION]: The execution steps involve shell scripting that uses variables derived from tool outputs (e.g., $FILE_NAME). If the external service returns a malicious filename (e.g., containing path traversal characters or shell metacharacters), the download and open commands could execute unintended actions or overwrite files.
Evidence: refly file download "$FILE_ID" -o "$HOME/Desktop/${FILE_NAME}" in SKILL.md.

wan-video