The Agent Skills Directory

[COMMAND_EXECUTION]: The documentation in SKILL.md suggests using Python's exec(open(...).read()) pattern and shell heredocs (`python3
<<'EOF'`) to execute the skill's logic within the agent's environment.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it interpolates user-provided text directly into strings sent to the image generation API without sanitization or protective boundary markers.
Ingestion points: The prompt parameter in the generate_3d function.
Boundary markers: None. User input is concatenated with static style templates.
Capability inventory: Network operations via the requests library and file system writes via _download_image in generate_3d.py.
Sanitization: No validation or escaping is performed on the user prompt before transmission.
[DATA_EXFILTRATION]: The reference_path parameter in the generation script allows reading local files. While the script implements extension validation (e.g., .jpg, .png) and a 10MB size limit, this surface could theoretically be used to probe for the existence of files or read data from files that happen to share these extensions.
[EXTERNAL_DOWNLOADS]: The skill downloads generated images from the fal.ai content delivery network. It also disables SSL certificate verification (verify=False) for these requests, which is a security weakness, though often used for compatibility with internal proxies.
[EXTERNAL_DOWNLOADS]: Dependencies and API calls target fal.ai (queue.fal.run), which is a well-known service for AI model hosting.

image-3d