The Agent Skills Directory

[COMMAND_EXECUTION]: The shell script jimeng.sh invokes a Python helper sign.py to perform HMAC-SHA256 signing for Volcengine API requests. This is a functional requirement and uses local files included in the skill.
[EXTERNAL_DOWNLOADS]: The skill performs network operations via curl to the Volcengine API (visual.volcengineapi.com) and a local bridge for Feishu (localhost:18789). These are documented behaviors for image generation and notification.
[INDIRECT_PROMPT_INJECTION]: The skill uses shell variable interpolation to construct JSON payloads for the Volcengine API. It lacks sanitization for characters like double quotes in the user-supplied prompt, which could allow for JSON structure manipulation if the agent processes untrusted data.
Ingestion points: The prompt and reference_url parameters in jimeng.sh.
Boundary markers: None.
Capability inventory: HTTP POST requests via curl to the Volcengine API and a local message endpoint.
Sanitization: No escaping or validation is performed on the prompt string before JSON construction.

jimeng