The Agent Skills Directory

[COMMAND_EXECUTION]: The gen.mjs and providers.mjs scripts utilize Node.js child_process.spawn to execute the dlazy CLI tool. This functionality is the primary mechanism for the skill to interact with its core services.
[DATA_EXFILTRATION]: The providers.mjs script reads local image files and transmits them to various external AI service providers, including OpenAI, Google Gemini, and the vendor's own API. These network operations are directed at well-known services and vendor-controlled infrastructure for the purpose of image processing.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data in the form of prompts and reference images, creating a potential surface for indirect injection attacks.
Ingestion points: User-supplied text prompts via the --prompt argument and image files or URLs via the --images argument in scripts/gen.mjs.
Boundary markers: The skill does not implement explicit delimiters or instruction-ignore warnings when interpolating user data into prompts or commands.
Capability inventory: The skill has the ability to execute shell commands (spawn in providers.mjs), perform network requests (fetch in providers.mjs), and read from the local file system (readFile in providers.mjs and brand.mjs).
Sanitization: While providers.mjs performs basic shell argument escaping for command construction, it does not sanitize the contents of the prompts sent to AI models.

cross-border-localize