The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill acts as a natural language expander, transforming user requests into structured JSON. This establishes a processing pipeline where instructions from a user could theoretically influence the generated output or the agent's behavior.
Ingestion points: Natural language asks from users are processed in examples.md and SKILL.md.
Boundary markers: The skill does not define specific delimiters or instructions to prevent the agent from obeying instructions embedded in the user's "casual ask."
Capability inventory: The skill utilizes a local CLI tool (tools/ideogram4.py) and reads local JSON files (brands/<brand>/brand.json).
Sanitization: No explicit sanitization of user-supplied text strings is mentioned before they are placed into the JSON schema's text or desc fields.
[COMMAND_EXECUTION]: The skill instructs the agent to execute a local wrapper tool (tools/ideogram4.py) using the uv run command. While this is standard for local tool integration, it involves the execution of shell commands with parameters generated from user-influenced data.
[DATA_EXFILTRATION]: Documentation in examples.md guides the agent to read brand-specific configuration files using a path constructed from a user-supplied brand name (brands/<brand>/brand.json). This pattern creates a potential path traversal surface if a user provides a malicious brand string containing directory traversal characters (e.g., ../../), although the risk is limited by the context of a documentation example rather than a script vulnerability.

ideogram4