The Agent Skills Directory

[DATA_EXPOSURE]: The skill safely manages API credentials by storing them in a local configuration file (~/.ai-hive/config.json) with restricted permissions. The imagegen.py script explicitly applies 0600 permissions (read/write for owner only) to this file using os.chmod during initialization.
[EXTERNAL_DOWNLOADS]: The script downloads generated media files from the official service domain (ai-hive.iclip.cn). These downloads are user-directed and are a core part of the skill's background replacement functionality.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user input via prompt text and image files, which are transmitted to the external AI Hive API.
Ingestion points: Prompt string and image file paths provided via CLI arguments in scripts/imagegen.py.
Boundary markers: None are applied to the user-supplied prompt before it is sent to the backend API.
Capability inventory: The skill is capable of performing network requests to the vendor's API and writing downloaded files to the local file system.
Sanitization: Input content is not sanitized locally, relying on the service provider's model-side safety filters.
[REMOTE_CODE_EXECUTION]: The script uses standard libraries for networking and file management. It does not use unsafe execution functions like eval() or os.system() to process user inputs, and it downloads only media assets rather than executable scripts.

seedream-5-lite-background-replace