The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill includes a self-update system (scripts/update.py) that downloads new versions from the official GitHub repository. This documented feature is secured by SHA-256 integrity verification against the GitHub API and validates archive content paths and file types before execution.
[EXTERNAL_DOWNLOADS]: The updater fetches release metadata and skill packages from api.github.com and github.com. These are well-known services and the downloads are verified using cryptographic digests provided by the vendor.
[COMMAND_EXECUTION]: The skill executes local Python scripts to perform core tasks including API key configuration, image generation, and update checks.
[DATA_EXFILTRATION]: User prompts and API credentials are sent to the official cloudrelay.cn API to facilitate image generation as intended. The skill follows secure practices by storing credentials in user-restricted configuration files or the Windows Registry instead of code or command-line arguments.
[DYNAMIC_EXECUTION]: Employs the compile() function during the update process to validate the Python syntax of newly downloaded scripts, ensuring they are intact before replacement.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text to generate images.
Ingestion points: Prompt input passed to the scripts/generate_image.py script.
Boundary markers: Prompts are handled as quoted strings within command-line invocations.
Capability inventory: The skill has network access for API calls and file writing for saving generated images.
Sanitization: No explicit filtering is applied to the prompt text, but the skill includes specific instructions for the AI agent to avoid repeating or leaking credentials in chat responses.

cloudrelay-imagegen