The Agent Skills Directory

[EXTERNAL_DOWNLOADS] (HIGH): The skill downloads files from a remote workflow (refly.ai) and executes the open command on the resulting files.
Evidence: In SKILL.md, Step 3 uses refly file download "$FILE_ID" followed by open "$HOME/Desktop/${FILE_NAME}".
Risk: There is no validation to ensure the downloaded file is an image. A malicious workflow could provide a shell script or executable (e.g., .sh, .command, or .app) which open would execute, leading to Remote Code Execution (RCE).
[COMMAND_EXECUTION] (MEDIUM): The skill uses shell scripts to process data retrieved from a remote API without sanitization.
Evidence: The variable ${FILE_NAME} is extracted from the remote JSON response using jq and used directly in the open command.
Risk: Maliciously crafted filenames could potentially be used for command injection or to overwrite sensitive files if the pathing is manipulated, although the fixed $HOME/Desktop/ prefix mitigates path traversal.
[INDIRECT_PROMPT_INJECTION] (MEDIUM): The skill possesses a high-risk capability (file execution) while ingesting untrusted data from an external workflow.
Ingestion Points: refly workflow toolcalls output in SKILL.md.
Boundary Markers: Absent; the skill blindly processes all files returned by the workflow.
Capability Inventory: File write to $HOME/Desktop and system-level execution via open.
Sanitization: None; the skill does not verify file extensions or MIME types before opening.

nano-banana