The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in references/codex-imagegen.md direct the agent to construct and execute shell commands to run a wrapper script. The path to this script is determined dynamically at runtime by walking the directory structure or reading environment variables like BAOYU_CODEX_IMAGEGEN_BIN.
Evidence: The skill provides templates for execution such as bun <WRAPPER>/main.ts and ${BUN_X} <baoyu-image-gen-base>/scripts/main.ts.
Risk: Dynamic path resolution and shell execution can lead to arbitrary command execution if the environment or inputs are manipulated.
[EXTERNAL_DOWNLOADS]: The skill describes a fallback mechanism that uses npx to run bun, which may trigger the download of external packages from the npm registry at runtime.
Evidence: npx -y bun <WRAPPER>/main.ts is explicitly listed as a last-resort invocation method in references/codex-imagegen.md.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests untrusted user data to generate image prompts and execute generation tools.
Ingestion points: The skill reads user-supplied text for infographic content and processes external image files via the --ref flag (documented in SKILL.md).
Boundary markers: Absent. The references/workflows/prompt-assembly.md guide shows direct interpolation of content into the prompt without delimiters or 'ignore' instructions.
Capability inventory: The skill has extensive capabilities, including writing files to the disk (prompts/, images), executing shell commands (bun, npx), and calling other agent skills.
Sanitization: No evidence of sanitization, filtering, or validation was found in the prompt assembly or content analysis workflows.

baoyu-xhs-images