The Agent Skills Directory

[SAFE]: The skill performs OCR via the vendor's API (somark.cn and somark.ai). All network communication is restricted to these legitimate service endpoints using the standard Python urllib library, minimizing the attack surface and dependency risks.- [SAFE]: Credential handling is implemented securely. The skill instructions and the supporting Python script prioritize the use of environment variables (SOMARK_API_KEY) and explicitly warn users against passing keys as command-line arguments to avoid exposure in system logs or process histories.- [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data in the form of text extracted from images. A potential injection surface exists where an attacker could embed instructions in an image (ingestion via image_parser.py). The skill provides clear boundary instructions in SKILL.md for the agent to treat all output as data and ignore instruction-like text. The capability inventory is limited to local file operations and specific vendor API access, with no high-privilege actions or unsanitized command interpolations detected.

image-parser