The Agent Skills Directory

[DATA_EXFILTRATION]: The analyze_image tool accepts an image_url parameter which is fetched by the system. This functionality creates a surface for Server-Side Request Forgery (SSRF), as an attacker could potentially provide URLs targeting internal network resources if the underlying vision service does not implement strict URL validation.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its processing of external content.
Ingestion points: Untrusted data enters the agent context via the image_url (external remote content) and image_path (workspace file content) parameters handled in handler.ts.
Boundary markers: There are no explicit markers or instructions to the LLM to ignore or isolate instructions that may be visually embedded or OCR-readable within the images being analyzed.
Capability inventory: The handler uses the VisionService to perform image analysis. The resulting analysis is returned to the agent, where it could potentially influence subsequent tool calls or reasoning steps if the image contains adversarial instructions.
Sanitization: No explicit sanitization of the user-provided prompt or the fetched image data is present in the handler logic.

image-analysis