The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill contains a hardcoded API key (376454-087dd0budxxo) within SKILL.md and api-reference.md. Although the documentation claims this is for convenience, hardcoding secrets in skill files is a dangerous practice that can lead to unauthorized access or credential harvesting.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using curl and ffmpeg based on data received from an external API (api.meowload.net). Specifically, it uses resource_url and headers from the API response directly in curl commands. If the API is compromised or returns malicious strings, this could lead to command injection or unauthorized file writes.
[EXTERNAL_DOWNLOADS]: The skill sends user-provided URLs to an external third-party domain (api.meowload.net) and downloads media from arbitrary resource_url locations returned by the API. This behavior involves sending potentially sensitive user browsing data to a third party.
[PROMPT_INJECTION]: The skill includes instructions specifically designed to restrict the agent's behavior regarding the disclosure of the built-in API key. While defensive in nature, these instructions attempt to control the model's output and safety behavior through natural language prompts.

puresnap