The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill includes a utility scripts/file_download.py that downloads files from user-provided URLs using the requests library. This functionality is intended to allow the agent to fetch data for processing within the local workspace.\n- [DATA_EXFILTRATION]: The skill enables uploading local files and directories to Volcano Engine TOS via scripts/tos_upload.py. While this sends data to a remote service, it is directed to the vendor's official volces.com endpoints and is the primary function of the skill.\n- [CREDENTIALS_UNSAFE]: The documentation includes instructions for the agent to guide users in setting up VOLCENGINE_ACCESS_KEY and VOLCENGINE_SECRET_KEY environment variables. This is a legitimate requirement for authenticating with the storage service.\n- [PROMPT_INJECTION]: The skill acts as an ingestion point for external data by downloading files from arbitrary URLs, which could potentially contain malicious instructions for subsequent agent steps.\n
Ingestion points: scripts/file_download.py downloads content from external URLs to the local filesystem.\n
Boundary markers: Absent; the script does not include delimiters or specific instructions for the agent to ignore embedded commands in downloaded files.\n
Capability inventory: The skill possesses file system access and network upload capabilities through the tos SDK.\n
Sanitization: Absent; files are saved in their original raw format without validation of contents.

tos-file-access