The Agent Skills Directory

[DATA_EXFILTRATION]: The skill's primary input parameter, image_url, is explicitly documented to support local file paths (e.g., "URL or local path to the source image", "Must be publicly accessible URL or local file path").
Evidence: In SKILL.md, the Required Parameters table and the Step-by-Step Instructions section explicitly state support for local paths.
Risk: An attacker could provide paths to sensitive files (e.g., ~/.ssh/id_rsa, /etc/passwd, .env) as the image_url. The agent would then attempt to read these files and send their content to the configured image processing backend (e.g., Stability AI, Automatic1111) as part of the image transformation process, leading to data exposure.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources, creating a vulnerability surface for indirect injection attacks.
Ingestion points: The image_url and mask_url parameters allow the skill to fetch content from untrusted external URLs.
Boundary markers: The skill does not define any delimiters or warnings to ignore instructions that might be embedded in the processed images (e.g., via steganography) or their metadata.
Capability inventory: The skill possesses the capability to read local files and perform network requests to external API backends as described in the Backend Implementations section.
Sanitization: There is no evidence of input validation or sanitization for the provided URLs or file paths to prevent directory traversal or access to restricted network resources.

image-to-image-edit