The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on executing several external binaries including oma, codex, agy (Antigravity), and gh (GitHub CLI) to process image generation requests.
[PRIVILEGE_ESCALATION]: The antigravity vendor implementation uses the agy CLI with the --dangerously-skip-permissions flag, which explicitly instructs the tool to bypass built-in security and permission checks.
[DATA_EXPOSURE]: The skill instructions direct the agent to access private, tool-specific directories such as ~/.claude/image-cache/ to retrieve reference images and ~/.codex for managing generated assets.
[EXTERNAL_DOWNLOADS]: The agent is instructed to fetch and process prompt libraries from external GitHub repositories under the YouMind-OpenLab organization to improve or 'amplify' image generation prompts.
[INDIRECT_PROMPT_INJECTION]: The skill exposes a significant attack surface by ingesting untrusted data from multiple external sources. This includes up to 10 user-provided reference images and external prompt templates fetched from GitHub, both of which are used to influence the agent's internal logic and output.
Ingestion points: Reference image paths supplied by the user (SKILL.md, execution-protocol.md) and external README files fetched from GitHub via gh api (resources/prompt-tips.md).
Boundary markers: None identified in the provided instructions to delimit external content or warn the agent to ignore embedded instructions in those sources.
Capability inventory: Subprocess execution of oma, codex, agy, and gh tools; file system read/write access to project and user home directories.
Sanitization: The skill performs magic-byte verification on reference images but does not appear to sanitize the textual content fetched from remote prompt libraries.
[DYNAMIC_EXECUTION]: The skill dynamically constructs shell commands by interpolating user-provided prompts and file paths into command strings for the oma, codex, and agy binaries.

oma-image