The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local CLI tools such as 'codex' and 'grok' to perform image generation. These subprocess calls are implemented using argument lists rather than raw strings, which prevents shell injection vulnerabilities. The use of these tools is integral to the skill's documented purpose.
[EXTERNAL_DOWNLOADS]: The skill fetches image assets and community character packs from the author's public GitHub repositories (tmchow/illo-skill and tmchow/illo-characters). These downloads are performed over HTTPS from a well-known service and are used exclusively for legitimate features like asset repair and character selection.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied concepts and external article content to build prompts for image generation. While this provides an attack surface for indirect prompt injection, the risk is mitigated by the use of rigid prompt templates and the fact that the resulting prompts are only used for image generation backends.
[SAFE]: The skill demonstrates excellent security hygiene regarding sensitive data. It uses an interactive method (getpass) for API key entry, stores credentials in a file with restricted permissions (0600), and includes specific instructions to the agent to avoid leaking secrets through environment variables or chat logs.

do-illo