The Agent Skills Directory

[COMMAND_EXECUTION]: Both scripts/gen_gemini.py and scripts/gen_gpt.py use subprocess.run() to invoke external CLI tools (agy and codex). User-supplied input from the prompt and --out arguments are interpolated directly into instruction strings that contain shell commands such as ls -la {dest} and file copy operations. Because this input is not sanitized, it creates a direct path for command injection if the backend tool executes the provided instructions as shell commands.
[PRIVILEGE_ESCALATION]: The scripts/gen_gemini.py script executes the agy CLI with the --dangerously-skip-permissions flag. This flag is used to suppress interactive approval prompts for the agent's tool calls (such as image generation and file system writes), effectively removing a security layer that would otherwise require user consent for sensitive actions.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection by processing untrusted user prompts and passing them to powerful backend agents with file system access.
Ingestion points: User-provided image prompts and output paths are ingested in SKILL.md and passed to the scripts.
Boundary markers: None. The prompt is simply appended to a long instruction string without delimiters or warnings to ignore embedded instructions.
Capability inventory: The skill uses subprocess.run to call external agents that can perform file writes (shutil.copyfile), directory listings (ls -la), and complex tool execution.
Sanitization: No validation or escaping is performed on the user-supplied prompt before it is sent to the backend CLI tools.

image-gen-router