The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on executing external commands via child_process.spawn in multiple scripts (scripts/gen.mjs, scripts/run_loop.mjs, and scripts/lib/providers.mjs). It wraps the dlazy CLI tool and local Python scripts to perform tasks like image generation, quality detection, and compliance checking.
[EXTERNAL_DOWNLOADS]: The scripts/lib/providers.mjs script facilitates communication with various AI service providers, including OpenAI, Google Gemini, Fal, Replicate, and ByteDance Ark, by sending prompts and images and receiving generated content.
[DYNAMIC_EXECUTION]: The workflow involves assembling and executing shell commands dynamically based on user-provided task parameters and prompts. While the script implements basic argument escaping, this mechanism is a core part of the skill's design for managing complex AI workflows.
[INDIRECT_PROMPT_INJECTION]: The skill implements a feedback loop in scripts/run_loop.mjs where the output of a quality check (the detect-task tool) is parsed, and suggested 'fixes' are automatically appended to the generation prompt for subsequent rounds. This creates a surface where malicious or adversarial content detected in an image (e.g., via OCR) could be extracted and injected into the AI's instruction context in the next iteration.
Ingestion points: The parseReport function in scripts/run_loop.mjs extracts suggested fixes from the text output of the detect-task quality checker.
Boundary markers: No explicit boundary markers or 'ignore embedded instructions' warnings are added when the extracted fixes are appended to the generation prompt.
Capability inventory: The skill uses child_process.spawn for command execution and fetch for network operations across its scripts.
Sanitization: The script does not sanitize the extracted 'fix' strings before interpolating them into the next prompt, relying on the quality check model's output accuracy.

detect-task