The Agent Skills Directory

[PERSISTENCE]: The skill documentation recommends that users add their OPENAI_API_KEY to shell profile files such as ~/.zshrc or ~/.bashrc to ensure the credential persists across sessions.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted user input in the form of image prompts and interpolate this data into Bash commands.
Ingestion points: User-provided <prompt> strings used in API requests.
Boundary markers: The skill does not define specific delimiters or instructions to treat the interpolated prompt as literal data, increasing the risk of the agent executing unintended shell sequences.
Capability inventory: The skill uses Bash to execute curl commands and Write to save output files to the workspace/ directory.
Sanitization: There are no explicit instructions or examples for sanitizing or escaping user input before it is embedded in the shell command strings.
[EXTERNAL_DOWNLOADS]: The skill connects to the OpenAI API at api.openai.com to generate image assets and subsequently downloads the resulting files from the generated URLs to the local workspace/ directory.
[COMMAND_EXECUTION]: The skill relies on executing curl and jq commands via the Bash tool to perform its primary function of generating and downloading images.

image-gen