The Agent Skills Directory

[DATA_EXFILTRATION]: The upload_file.py script facilitates the reading and uploading of local files to an external server (im.liblib.tv). While the script implements basic MIME type checks to ensure only images and videos are uploaded, the capability to transmit local file content to a remote endpoint presents a surface for potential data exposure if the agent is manipulated into uploading sensitive files.
[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it ingests and processes untrusted data from an external API.
Ingestion points: Remote message content is retrieved via the query_session.py script from the Liblib API.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the retrieved API content as untrusted data.
Capability inventory: The skill possesses capabilities for network communication and local file access across all its scripts.
Sanitization: No sanitization, escaping, or validation is performed on the message content retrieved from the external source before it is presented to the agent.
[EXTERNAL_DOWNLOADS]: The skill performs legitimate network operations to the vendor's domains, im.liblib.tv and liblib.art, to manage AI sessions and upload media assets.

libtv-skill