The Agent Skills Directory

Data Exfiltration (HIGH): The script facilitates the upload of arbitrary local files to a third-party cloud service without path validation.- Evidence: In media-understand.js, the MEDIA_PATH variable is initialized directly from user-controlled command-line arguments (opts.media).- Evidence: The resolveMediaForModel function takes this path and passes it to falUploadFile(mediaPath), which reads and uploads the file to an external endpoint.- Risk: A malicious actor could provide paths to sensitive files such as ~/.aws/credentials, /etc/passwd, or .env files. These files would be uploaded to the FAL storage proxy and potentially disclosed to the user through the model's analysis or the returned upload URL.- Indirect Prompt Injection (LOW): The skill processes untrusted media content that may contain hidden instructions for the LLM.- Ingestion points: File media-understand.js via the --media argument (images, videos, audio).- Boundary markers: Absent. The user prompt and the media reference are sent to the model without explicit delimiters or instructions to ignore embedded content.- Capability inventory: File system read access (fs), network file uploads (falUploadFile), and model completions via API (falRun).- Sanitization: No sanitization or verification of the media content's safety or source is performed.

media-understand