The Agent Skills Directory

[PROMPT_INJECTION]: The documentation file references/model-flags.md contains a 'CRITICAL INSTRUCTION' directive that tells the agent to run a specific command. While used for functional guidance, this pattern mimics techniques used to override safety guardrails.
[COMMAND_EXECUTION]: The scripts/lib/providers.mjs script uses child_process.spawn to execute the dlazy command-line utility. This allows the skill to execute local binaries with arguments derived from user input.
[DYNAMIC_EXECUTION]: The execution path for the dlazy tool can be overridden via the DLAZY_BIN environment variable in scripts/lib/providers.mjs, allowing the skill to target different binaries at runtime.
[EXTERNAL_DOWNLOADS]: The skill uses the fetch API in scripts/lib/providers.mjs and scripts/gen.mjs to download image assets from remote URLs provided in input arguments.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external images and prompts, which are then used to build instructions for AI models.
Ingestion points: Untrusted content enters the system through --prompt, --images, and --brand arguments in scripts/gen.mjs and scripts/brand.mjs.
Boundary markers: The skill does not employ explicit delimiters or specialized formatting to isolate untrusted content from its internal instruction logic.
Capability inventory: The skill has the capacity to execute local commands, write files to the file system, and perform network requests.
Sanitization: There is no evidence of robust validation or escaping of input data before it is used for prompt interpolation or file path construction.

one-shot