The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prompts and external media URLs (e.g., image_url, video_url) for generation tasks, creating a surface for potential injection attacks embedded in processed data.
Ingestion points: prompt fields in Video, Image, and TTS generation; image_url and video_url in reference-based generation and lip-sync tools.
Boundary markers: No explicit delimiters for prompt interpolation are mentioned, though a character limit (2500) for prompts is noted.
Capability inventory: The skill involves network requests to api-singapore.klingai.com and reading local files to convert them to base64 for upload.
Sanitization: Validates that callback URLs are absolute http or https links; enforces character limits on prompts.
[COMMAND_EXECUTION]: The skill instructions reference the execution of local helper scripts (tools/_kling/media.py, tools/_kling/elements.py, tools/_kling/account.py) to perform media normalization, element management, and account usage checks via the Kling API.

kling-official