The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script is designed to retrieve API keys from a standard local configuration file.
Evidence: The _load_dashscope_api_key_from_credentials function in scripts/analyze_image.py reads from ~/.alibabacloud/credentials to authenticate requests.
[PROMPT_INJECTION]: The skill processes untrusted user input that is interpolated into payloads sent to the AI model, representing an indirect prompt injection surface.
Ingestion points: The prompt and image fields in the request JSON provided via CLI arguments or files.
Boundary markers: Absent; user content is placed directly into the content list of the model message.
Capability inventory: Performs network POST requests to the Alibaba Cloud DashScope API using the requests library.
Sanitization: No validation or sanitization is performed on the user-provided text or image sources before processing.
[COMMAND_EXECUTION]: The skill documentation provides shell commands for setup and validation that perform filesystem and compilation operations.
Evidence: SKILL.md includes commands for mkdir and python -m py_compile to verify the script environment.

alicloud-ai-multimodal-qwen-vl