The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/contact_sheet.py uses subprocess.run to execute a command-line interface tool (provided via the --cli argument). The script executes commands with shell=False (default) using a list of arguments, which is a secure practice to prevent shell injection.
Evidence: process = subprocess.run([str(cli), *args], capture_output=True, text=True, encoding='utf-8', errors='replace') in scripts/contact_sheet.py.
[INDIRECT_PROMPT_INJECTION]: The skill processes external image files and uses their filenames as text labels in the generated contact sheets. This represents a data ingestion surface where external content is interpolated into tool commands.
Evidence: The script reads image file metadata and incorporates the filename into the type.create command parameters. It includes validation to ensure filenames do not contain control characters or newlines.
[EXTERNAL_DOWNLOADS]: The documentation mentions installing a companion skill photocraft-editor using npx. This reference is to a resource within the same vendor's ('full-aigc-skills') infrastructure.
Evidence: npx skills add full-aigc-skills/photocraft-skills --skill photocraft-editor in SKILL.md.

photocraft-batch-image-delivery