The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses inline Python scripts (heredocs) within SKILL.md to process API responses, perform Base64 decoding of image data, and handle configuration parsing. This involves executing dynamically generated code at runtime.
[COMMAND_EXECUTION]: The instructions direct the agent to execute shell commands, including curl for network requests and python3 for execution logic, to interact with external image generation endpoints and manage local files.
[DATA_EXFILTRATION]: The skill accesses a local configuration file (~/.config/imagegen/auth.json) containing sensitive API credentials. These credentials are transmitted to user-defined endpoints in the Authorization header of outbound network requests. While this is the intended fallback mechanism, it constitutes access to and transmission of sensitive data.
[PROMPT_INJECTION]: User-provided prompts are interpolated directly into shell commands and API request payloads (e.g., within a curl data string) without explicit sanitization or boundary markers. This creates an indirect prompt injection surface that could lead to command injection if malicious input is provided.
[EXTERNAL_DOWNLOADS]: The installer scripts (install.sh and bin/create-image-codex.js) perform a git clone from the author's GitHub repository to install the skill and its dependencies. This is a standard installation pattern for this vendor's tools.

imagegen