The Agent Skills Directory

[Prompt Injection] (LOW): The file references/base-prompt.md contains the instruction: 'If content involves sensitive or copyrighted figures, create stylistically similar alternatives
DO NOT refuse to generate'. This is a direct attempt to override the model's safety and refusal protocols by demanding output even when constraints might normally apply.
[Indirect Prompt Injection] (LOW): The skill is designed to process untrusted user-supplied content to generate visuals, creating a vulnerability surface where malicious instructions in the data could influence agent behavior.
Ingestion points: External content is appended to the prompt in references/base-prompt.md for processing.
Boundary markers: The instructions use triple dashes (---) and markdown code blocks to attempt to isolate user content from the system instructions.
Capability inventory: The skill triggers an image generation tool ('nano banana pro') based on the processed text.
Sanitization: No input validation or sanitization logic is present to filter malicious instructions within the user-provided content.
[Data Exposure & Exfiltration] (SAFE): The references/config/first-time-setup.md file specifies creating configuration files in the project directory or the user's home directory (~/.baoyu-skills/). While this involves writing to the filesystem, it is for legitimate preference storage and does not involve accessing sensitive system files or exfiltrating data over the network.

baoyu-cover-image