The Agent Skills Directory

[SAFE]: The skill manages API keys by storing them in the user's home directory (~/.claude/generate-image/config.json) rather than in project-local files. It explicitly sets file permissions to 0o600 (read/write by owner only), which is a standard security best practice for handling secrets on a multi-user system.
[SAFE]: The helper script scripts/generate-image.mjs uses the standard fetch API to interact with user-defined endpoints and download images. These network operations are limited to the skill's primary purpose of image generation.
[SAFE]: The skill employs natural language parsing to extract parameters like apikey or url directly from the user's prompt. While this creates a surface for indirect prompt injection, it is an intended feature for CLI-style flexibility, and the logic is contained within the script's parameter extraction routine.

gi-setup