The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous command-line examples using curl and openssl to interact with the Lovart API. These commands compute necessary HMAC headers and perform standard HTTP requests to the service's endpoints at lgw.lovart.ai (found in SKILL.md).
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied strings for design prompts and project metadata, representing a potential surface for indirect prompt injection attacks.
Ingestion points: The skill accepts user input for the prompt field in lovart_chat.json and the project_name field in lovart_project.json (documented in SKILL.md).
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat this user input as untrusted or to ignore embedded instructions.
Capability inventory: The skill has the ability to execute shell commands (curl, openssl), perform network operations to the Lovart API, and write temporary files to the /tmp/ directory.
Sanitization: No sanitization or validation logic is defined within the skill instructions to filter the user-supplied content before it is processed.
[SAFE]: All external communications are directed to the primary service domain lovart.ai and its related documentation sites, which are the intended targets for the skill's functionality. Authentication secrets are managed via environment variables, following security best practices.

lovart