The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses child_process.spawn in scripts/lib/providers.mjs to invoke the vendor-owned dlazy CLI tool for image generation. This tool is executed with arguments derived from user input, though it uses safe invocation methods that avoid shell interpretation.
[EXTERNAL_DOWNLOADS]: The generation scripts communicate with external AI service providers including OpenAI, Google Gemini, Fal.ai, Replicate, and Volcengine. It also supports fetching image assets from remote URLs provided by the user.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user prompts and images and incorporates them into instructions sent to AI models, creating a potential vector for indirect prompt injection.
Ingestion points: User-supplied strings via the --prompt flag and image paths/URLs via the --images flag in scripts/gen.mjs.
Boundary markers: The skill does not implement explicit boundary delimiters or safety instructions when interpolating user content into the final model prompts.
Capability inventory: The skill has the capability to write files to the local disk (persist in gen.mjs), perform network requests (fetch in providers.mjs), and execute a local binary (execFileJson in providers.mjs).
Sanitization: There is no explicit sanitization or filtering of user-provided prompt text or image metadata before processing.

clothing-grass-planting