The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/download_urls.py script downloads images from arbitrary URLs provided in a JSON manifest. This allows the skill to interact with non-whitelisted external domains during its normal operation.
[INDIRECT_PROMPT_INJECTION]: The skill represents a vulnerability surface for indirect prompt injection as it performs web searches and ingests content (titles, captions, metadata) from untrusted external websites to build its moodboard manifest.
Ingestion points: Web search results and image metadata (described in SKILL.md Workflow steps 3 and 4).
Boundary markers: None present to instruct the agent to ignore instructions embedded in the external content.
Capability inventory: The skill uses scripts/download_urls.py (Network access) and scripts/render_moodboard.py (File read/write).
Sanitization: Absent. The render_moodboard.py script directly interpolates content from the manifest into HTML strings using f-strings, creating a Cross-Site Scripting (XSS) vulnerability.
[DYNAMIC_EXECUTION]: The scripts/render_moodboard.py script uses the rel_to_manifest function to resolve image paths. This function allows absolute paths and does not validate that the paths remain within the intended downloads directory, enabling the script to attempt to read any file on the system that the Pillow library can open.
[DATA_EXFILTRATION]: The path traversal vulnerability in rel_to_manifest, combined with the script's capability to process and re-save images, creates a risk of local file exposure if an attacker can influence the contents of the manifest.json file through indirect prompt injection.

emotional-canvas-moodboard