The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in SKILL.md direct the agent to source the user's shell configuration file (~/.zshrc) to load environment variables. Sourcing an RC file involves executing its contents within the current shell session, which effectively allows for the execution of arbitrary code stored in that configuration file.
[INDIRECT_PROMPT_INJECTION]: The skill's workflow involves processing external and user-supplied data that could influence the agent's actions.
Ingestion points: The script scripts/minimax_h3.py facilitates reading local media files (images, videos, audio) which are then processed and uploaded as references.
Boundary markers: The skill relies on natural language structuring in the prompt guides but lacks technical enforcement or isolation to prevent malicious instructions within media or prompts from being followed.
Capability inventory: The skill is capable of filesystem writes through its download command, making network requests to external endpoints, and shell command execution via the sourcing instruction.
Sanitization: There is no implemented sanitization or validation logic for the logical content of ingested media or the generated prompt strings beyond file type and size checks.
[DATA_EXFILTRATION]: The scripts/minimax_h3.py tool supports a callback_url parameter in its create operation. If an attacker manages to inject a malicious URL through a prompt or manipulated media reference, the service could be directed to send task data to an unauthorized third-party endpoint.

minimax-h3-video