The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted user content (articles, notes, or pasted text) to generate visual outlines and image prompts. This establishes an indirect prompt injection surface where maliciously crafted input could attempt to manipulate the agent's behavior.
Ingestion points: The skill reads source material into source.md (Step 1) and analyzes it to create analysis.md.
Boundary markers: No explicit delimiter markers are used in the prompt templates to isolate user content.
Capability inventory: The agent has the capability to write files (outline.md, prompts/) and invoke image generation tools.
Sanitization: No explicit sanitization or filtering of input content is mentioned.
Mitigation: The risk is effectively mitigated by the skill's architecture, which requires mandatory human review and confirmation at two distinct stages (Step 2: Content Analysis and Step 4: Outline/Style Selection) before any significant actions or image generations occur.
[COMMAND_EXECUTION]: The skill utilizes standard shell commands (test -f, echo) to manage its execution environment. These commands are used solely for benign purposes, such as checking for the existence of the EXTEND.md preference file in the project or user home directory. The workflow documentation also mentions a CLI command (npx -y bun) for executing a local script (scripts/main.ts) to maintain visual consistency across an image series; this is a standard developer-oriented pattern for the intended use case.

baoyu-xhs-images