The Agent Skills Directory

[COMMAND_EXECUTION]: The execFileJson function in scripts/lib/providers.mjs uses spawn to run the dlazy command-line tool. This enables the skill to perform image generation by calling external binaries associated with the vendor's toolset.
[EXTERNAL_DOWNLOADS]: The persist function in scripts/gen.mjs downloads processed image assets from AI provider URLs (e.g., those from OpenAI, Replicate, or the vendor's own hosting at files.dlazy.com) using fetch and writes them to the local file system.
[DATA_EXFILTRATION]: User prompts and image data are transmitted to external AI service providers (OpenAI, Google, Replicate, Fal, ByteDance, and dLazy) to facilitate the image editing and reconstruction process. This is the core functionality of the skill.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because it processes untrusted image inputs that could contain adversarial content.
Ingestion points: External images are loaded via the gen.mjs script's --images parameter and the brand configuration files.
Boundary markers: The instructions in skill.md provide structured prompts using "Delete" and "Keep" lists to define the task scope and separate instructions from content.
Capability inventory: The skill includes capabilities for file system writes in gen.mjs and network requests to AI service endpoints in providers.mjs.
Sanitization: The skill relies on the downstream AI provider's safety filters as there is no local sanitization of visual image content.

remove-watermark