The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external image files which represent a potential surface for indirect injection via embedded metadata. The skill mitigates this risk by providing specific instructions to strip metadata from user-contributed content.
Ingestion points: The sharp() constructor in resize.js, responsive.js, and batch.js accepts file paths and buffers from potentially untrusted sources.
Boundary markers: Not applicable as the skill handles binary image data rather than natural language prompts.
Capability inventory: The skill uses .toFile() to write transformed images to the file system and .metadata() to read file properties.
Sanitization: The instructions explicitly recommend using .withMetadata({ orientation: undefined }) to strip EXIF metadata (GPS, timestamps, etc.) for privacy and security.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of the sharp library via npm install sharp. This is a standard and well-known dependency for image processing in the Node.js ecosystem and is used here according to its intended purpose.

sharp