The Agent Skills Directory

[COMMAND_EXECUTION] (SAFE): The skill uses curl and jq for interacting with the Pexels API and processing JSON responses. These commands are used for their intended purpose and do not execute arbitrary user input.
[EXTERNAL_DOWNLOADS] (SAFE): Media and API requests are directed to api.pexels.com, images.pexels.com, and videos.pexels.com. These are legitimate domains for the skill's stated purpose.
[CREDENTIALS_UNSAFE] (SAFE): The skill correctly instructs the user to set the PEXELS_API_KEY as an environment variable and does not contain hardcoded secrets.
[PROMPT_INJECTION] (LOW): Indirect Prompt Injection Surface (Category 8):
Ingestion points: API responses from Pexels (e.g., alt tags, photographer names) are captured and saved to .meta.json files.
Boundary markers: None; external data is interpolated directly into a JSON structure via jq.
Capability inventory: The skill uses curl for network access and writes to the local file system.
Sanitization: The use of jq provides inherent protection against command injection during the creation of the metadata file by properly escaping strings, but the content itself remains untrusted data that could influence the agent if read back into the prompt context later.

pexels-media