The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions direct the agent to clone an external git repository (https://github.com/Spicy-API/nsfw-ai-skill) and execute a Python script (scripts/spicy.py) located within the cloned directory. Executing code fetched from an untrusted third-party source at runtime is a high-risk activity.
[EXTERNAL_DOWNLOADS]: The skill relies on fetching scripts and content from an external GitHub repository that is not part of the established trusted vendor or well-known service lists.
[DATA_EXFILTRATION]: The skill is designed to send user-provided prompts and upload local image files to the external API endpoint api.spicyapi.ai. While this is the primary purpose of the skill, it creates a surface for the exfiltration of potentially sensitive local data.
[COMMAND_EXECUTION]: The skill utilizes shell commands such as git clone, git checkout, and python3 to set up and run its components, which increases the potential attack surface if inputs are manipulated.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: Untrusted data enters the agent's context through user prompts and local image files used as arguments for the generation commands (e.g., in SKILL.md).
Boundary markers: The instructions include natural language safety guidelines but lack technical boundary markers or explicit sanitization for the CLI arguments used in the examples.
Capability inventory: The skill possesses the capability to execute shell commands, perform network requests, and read/upload local files.
Sanitization: There is no evidence of escaping or validation of the {prompt} or {image} inputs before they are passed to the spicy.py script via shell execution.

nsfw-ai-spicyapi