The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions contain a hardcoded API key used for external service authentication.
Evidence: X-API-Key: vts_qxNIE-yuAKcuRnH8NOEMndKF60hBf9Q53ihQmWQjTVw is hardcoded in SKILL.md for both upload and status check operations.
[DATA_EXFILTRATION]: The skill is configured to upload user media files to an unverified external endpoint over an insecure protocol.
Destination: http://121.15.2.62:17800/api/upload.
Risk: User audio and video files, which may contain sensitive personal or corporate information, are sent over unencrypted HTTP. This allows the data and the hardcoded API key to be captured by third parties. The destination is a raw IP address rather than a verified domain.
[PROMPT_INJECTION]: The skill processes transcription data, which serves as an entry point for indirect prompt injection.
Ingestion points: Reads transcription files (Markdown and JSON) from the local environment or the API response.
Boundary markers: No delimiters or instructions to ignore embedded commands within the transcripts are provided.
Capability inventory: The skill performs selection, sorting, and structural assembly of text segments into scripts.
Sanitization: No evidence of sanitization or content validation is found in the processing pipeline.

clip-script-skill-backup