The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text prompts and external media assets (images, videos, audio) via URLs. This creates a surface for indirect prompt injection where malicious instructions could be embedded in the text or metadata of the referenced files.
Ingestion points: Parameters prompt, image, end_image, reference_images, reference_videos, and reference_audios in SKILL.md are used to feed data into the generation model.
Boundary markers: None are present in the skill instructions to delimit untrusted user input from system instructions.
Capability inventory: The skill uses the Bash(belt *) tool to execute shell commands (belt app run), providing a path for potential exploitation if the CLI tool does not sufficiently sanitize inputs.
Sanitization: There is no evidence of sanitization, validation, or escaping of the user-provided prompts or external URLs before they are passed to the CLI command.
[COMMAND_EXECUTION]: The skill heavily relies on executing shell commands via the belt CLI. It uses belt login for authentication, belt app run for model execution, and belt app search/list for discovery. These commands are executed within a Bash environment with belt * permissions.
[EXTERNAL_DOWNLOADS]: The skill references and encourages the download of external resources from the vendor's infrastructure:
Fetches installation instructions from the inference-sh GitHub repository: https://raw.githubusercontent.com/inference-sh/skills/refs/heads/main/cli-install.md.
Instructs the user to install an additional skill using npx skills add belt-sh/cli.

seedance