The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in SKILL.md provide shell command templates that directly interpolate unvalidated user input: node scripts/generate_image.js -p "{prompt}". This construction is vulnerable to command injection if the prompt contains shell metacharacters such as ;, &, or $(), allowing for arbitrary code execution on the host.
[DATA_EXFILTRATION]: The scripts/generate_image.js script reads local image files provided via the -i flag and transmits them, along with the user's prompt, to an external API endpoint (apihub.agnes-ai.com). This provides a channel for the exfiltration of sensitive local data.
[COMMAND_EXECUTION]: The script scripts/generate_image.js allows for writing output to any file path provided via the -f flag using fs.writeFileSync. This capability could be exploited to overwrite critical configuration files or system binaries if the agent is manipulated into using restricted paths.
[EXTERNAL_DOWNLOADS]: The skill documentation refers users to https://www.agnes-ai.com for registration and API key acquisition. This domain is not a recognized trusted organization or well-known service.
[CREDENTIALS_UNSAFE]: The skill relies on an API key stored in the AGNES_API_KEY environment variable. While not hardcoded, the transmission of this key to an external, non-whitelisted service presents credential handling risks.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted user prompts and input images and uses them in network and file operations without sanitization.
Ingestion points: User prompts via the -p flag and local files via the -i flag in scripts/generate_image.js.
Boundary markers: Absent in both the script and the instructions.
Capability inventory: Network requests via HTTPS and local file read/write operations within scripts/generate_image.js.
Sanitization: No validation or escaping of the prompt or file content is implemented before processing.

haizei-agnes-image-gen