The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of user-supplied prompts and external image URLs through the BFL API, creating a standard attack surface for indirect prompt injection.
Ingestion points: User prompts and input_image URLs defined in SKILL.md and reference client implementations.
Boundary markers: Code templates do not include specific delimiters to isolate untrusted user content within API requests.
Capability inventory: The skill enables network operations (HTTP POST/GET) and local file writing (image downloads) across all reference scripts.
Sanitization: While client examples validate image dimensions, they do not perform sanitization on the prompt content itself, relying on the third-party API's internal filters.
[EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading generated image assets from Azure Blob Storage (bfldeliveryprod.blob.core.windows.net) and fetching input images from user-supplied URLs. These operations are essential to the skill's primary function and target legitimate, well-known service domains.

bfl-api