The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill manages its installation and updates through the author's repository (codeh007/mtmskills) using the npx command.
[EXTERNAL_DOWNLOADS]: The image generation script communicates with an external API endpoint at yuepa8.com to fulfill image requests.
[COMMAND_EXECUTION]: The skill executes a localized Node.js script (scripts/generate.mjs) to process user prompts and handle binary image data.
[DATA_EXFILTRATION]: User-provided prompts and the dedicated MTMAI_IMAGE2_KEY are transmitted to the yuepa8.com service. This data transfer is the intended function of the skill for the purpose of image generation.
[PROMPT_INJECTION]: The skill contains instructions to prioritize its execution and skip environment pre-checks ("直接执行；不要预检"). This design choice streamlines the user experience but reduces the agent's initial verification steps. Additionally, while user prompts are structurally validated as JSON, the content is passed to the remote API without internal sanitization (Ingestion: Stdin; Boundaries: JSON parsing; Capabilities: Network/File-Write; Sanitization: None).
[SAFE]: The implementation includes defensive programming practices, such as verifying PNG signatures, chunk structures, and CRC32 checksums before saving files. It also utilizes atomic writes with temporary files and ensures sensitive environment files are created with restricted permissions (chmod 600, umask 077).

mtm-image2