The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses child_process.spawn in scripts/lib/providers.mjs and scripts/gen.mjs to execute the dlazy CLI tool. This is the intended mechanism for performing image generation tasks.
[EXTERNAL_DOWNLOADS]: The providers.mjs script performs network requests via fetch to download reference images from user-supplied URLs and to interact with AI provider APIs (OpenAI, Google Gemini, Fal, Replicate, and Volcengine Ark). These are well-known or vendor-owned services.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests untrusted data (commodity names, brand descriptions, and selling points) and interpolates them into prompt strings without sanitization.
Ingestion points: brand.yaml configuration file and CLI arguments provided at runtime.
Boundary markers: Absent. The skill concatenates user input directly into instructions.
Capability inventory: The skill possesses capabilities for command execution (spawn), file system operations (readFile, writeFile), and network communication (fetch).
Sanitization: No explicit escaping or validation is performed on the user-supplied text before prompt interpolation.
[DYNAMIC_EXECUTION]: The skill includes several Node.js scripts (gen.mjs, brand.mjs, lib/providers.mjs) that are executed to coordinate the generation workflow. These scripts are provided in plain text and perform standard automation tasks.

fission-pattern