The Agent Skills Directory

[SAFE]: The skill's primary logic in scripts/modelscope-api.js and scripts/examples.js is dedicated to providing an interface for ModelScope services. No malicious patterns such as credential theft, persistence mechanisms, or unauthorized privilege escalation were identified.
[EXTERNAL_DOWNLOADS]: The skill requires standard, well-known libraries to function. These include node-fetch for JavaScript and requests, pillow, and openai for Python. These are sourced from official registries (NPM and PyPI) and are used for their intended purposes of network communication, image processing, and API compatibility.
[PROMPT_INJECTION]: The skill acts as a conduit for user-provided instructions to AI models, which is an inherent surface for indirect prompt injection. This is standard for AI interface tools and does not indicate a specific vulnerability in the skill itself.
Ingestion points: User input is received via the messages array in chatCompletion() and the prompt string in generateImage() in scripts/modelscope-api.js.
Boundary markers: Not present; the skill treats user input as the primary data payload for the API requests.
Capability inventory: The skill is capable of performing authenticated HTTPS POST requests to the official ModelScope inference endpoint.
Sanitization: No content filtering is applied locally, as the skill relies on the ModelScope platform's built-in safety filters and guardrails.

modelscope-api