The Agent Skills Directory

[DATA_EXFILTRATION]: The skill manages a Google API key provided by the user. While the key is stored in a local config.json file, the script implements masking (via jq) to ensure the key is never printed to the console or logs. Network requests are exclusively made to generativelanguage.googleapis.com, which is a well-known service belonging to Google.
[COMMAND_EXECUTION]: The skill utilizes bash scripts to handle image generation and configuration. It uses standard tools like curl for API communication, jq for JSON processing, and base64 for image decoding. These operations are scoped to the skill's purpose and project directory.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text through the --prompt argument to generate images. This data is passed to an external API. The skill mitigates risks by using jq to properly sanitize and encode the user input into a structured JSON payload before transmission.
Ingestion points: User-supplied prompts in SKILL.md and the handle_generate function in scripts/acestep-thumbnail.sh.
Boundary markers: Input is strictly encapsulated within a JSON object constructed by jq.
Capability inventory: Subprocess calls via Bash, file writes for the generated image, and network operations via curl.
Sanitization: Prompt text is treated as a string value within the JSON payload, preventing command or schema injection during transmission.

acestep-thumbnail