The Agent Skills Directory

[DATA_EXPOSURE]: The _load_image function in scripts/generate.py reads local files using paths provided in the image_url parameter. Since this parameter is controlled by the agent's input and the script lacks path validation or sandboxing, it is possible to read arbitrary files from the filesystem that the process has access to.
[DATA_EXFILTRATION]: When performing image editing or fusion tasks, the script reads local files and sends the resulting data (base64-encoded) to external API endpoints belonging to providers like LinkAI, OpenAI, Google, and others. If a sensitive system file is provided as the image_url, its content will be exfiltrated to these third-party services.
[EXTERNAL_DOWNLOADS]: The skill uses the requests library or urllib to fetch content from arbitrary remote URLs provided in the image_url parameter.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect injection attacks because it processes untrusted data (paths and URLs) and incorporates them into sensitive operations without sanitization. An attacker could trick the agent into accessing and leaking sensitive credentials or configuration files.
Ingestion points: The image_url parameter in scripts/generate.py, which is populated from the skill's arguments.
Boundary markers: None. The script does not utilize delimiters or specific instructions to prevent the agent from following malicious paths provided in the prompt context.
Capability inventory: The script possesses file-read capabilities (open) and network transmission capabilities (requests.post, urllib.request.urlopen) across multiple providers.
Sanitization: None. The script only verifies the existence of a file using os.path.isfile but does not validate the file type or ensure the path is restricted to the workspace directory.

image-generation