The Agent Skills Directory

[COMMAND_EXECUTION]: The gen.mjs and providers.mjs scripts utilize the dlazy command-line tool via child_process.spawn to perform image generation and retrieve task statuses.
[EXTERNAL_DOWNLOADS]: The gen.mjs script downloads generated image buffers from AI provider URLs (such as those from Replicate or OpenAI) to store them in the local output directory.
[DATA_EXFILTRATION]: Local image references and brand visual descriptions are transmitted to external AI service endpoints, including OpenAI, Google Gemini, Fal.ai, and Replicate, to facilitate the image generation process.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-controlled content from brand.yaml configuration files which is then interpolated into prompts for image generation models.
Ingestion points: Data is read from brand.yaml (specifically fields like tone, description, body, and photography attributes) in scripts/brand.mjs.
Boundary markers: The buildBrand function wraps these values in descriptive labels (e.g., 'Model must stay consistent: ', 'Color grade: ') which provides basic structural delimitation.
Capability inventory: The skill possesses the ability to execute a local binary (dlazy), perform HTTP POST requests to multiple AI APIs, and write image files to the local disk.
Sanitization: The custom YAML parser in scripts/lib/miniyaml.mjs performs type coercion and basic string trimming but does not implement security-specific filtering for prompt injection patterns.

brand-kit