The Agent Skills Directory

[DYNAMIC_EXECUTION]: The illustrate.py script dynamically locates and executes external image backend scripts (e.g., gpt-image-2, nano-banana) on the local system.\n
The discovery logic in probe_backends searches for scripts using paths defined in environment variables like HUMANE_IMAGE_BACKEND and HUMANE_SKILLS_DIR, as well as standard agent skill directories (e.g., ~/.claude/skills).\n
These scripts are then executed via subprocess.run. This behavior is the central function of the adapter, but it relies on external code execution from paths that can be influenced by project or environment configuration.\n- [INDIRECT_PROMPT_INJECTION]: The skill incorporates data from external JSON token files (design.tokens.json) directly into prompts for image generation and generated gallery metadata.\n
Ingestion points: The skill reads brand attributes (such as mood and imageryStyle) and font names from user-supplied token files in illustrate.py.\n
Boundary markers: There are no explicit delimiters or instructions provided to separate the external brand data from the rest of the generation prompt, making the downstream generator potentially susceptible to instructions embedded in these files.\n
Capability inventory: The skill uses subprocess.run to call generators and writes HTML files (gallery.html, contact-sheet.html) based on this data.\n
Sanitization: The skill does not sanitize or validate token file content before interpolation, which allows for potential XSS in generated HTML galleries if filenames or subjects contain malicious scripts.\n- [COMMAND_EXECUTION]: The skill constructs and executes command-line strings to invoke local backend scripts.\n
It uses subprocess.run to call the interpreted Python scripts or binary executables discovered during its probing phase.

brand-illustrate