The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/check-prerequisites.sh script downloads the installation script for the uv package manager from astral.sh, which is a well-known service for Python tooling.
[REMOTE_CODE_EXECUTION]: The script downloaded from astral.sh is piped to the shell for execution in scripts/check-prerequisites.sh. This is the documented and standard installation method for the utility.
[COMMAND_EXECUTION]: The script scripts/generate_image.py executes the system open command to display generated images. This call is implemented safely using subprocess.run with a list of arguments, preventing shell command injection.
[CREDENTIALS_UNSAFE]: The skill utilizes a GEMINI_API_KEY provided via environment variables. The documentation correctly instructs users on how to set this up securely and explicitly warns against committing API keys to version control systems.
[PROMPT_INJECTION]: The skill interpolates user-provided prompts into templates sent to an external AI model. Ingestion points: User input via the -p flag in scripts/generate_image.py. Boundary markers: Prompt templates use structured headers and logical sections to delimit data. Capability inventory: The skill can execute shell commands, perform network requests to Google APIs, and write image files to the local file system. Sanitization: User inputs are placed within defined prompt templates that scope the model's tasks to Salesforce visual generation.

external-diagram-visual-generate