The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on external binary execution to fulfill its functionality. Specifically, scripts/codex-imagegen/spawn.ts spawns the codex CLI tool for image generation tasks, and scripts/providers/google.ts executes curl via execFileSync to handle network requests when an HTTP proxy is detected in the environment.
[DATA_EXFILTRATION]: The skill accesses sensitive information including API keys for multiple providers (OpenAI, Google, Alibaba, Volcengine) stored in environment variables or .env files. These credentials, along with user-provided prompt text and reference images, are sent to various third-party AI service endpoints during the generation process.
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted external content as input for AI models.
Ingestion points: User-provided prompt text via --prompt, markdown files via --promptfiles, and reference images via --ref are all ingested into the agent context in scripts/main.ts.
Boundary markers: The skill does not employ explicit delimiters or 'ignore embedded instructions' warnings when interpolating this external content into the final prompts sent to providers.
Capability inventory: Across its various provider scripts, the skill has the capability to write files, perform network operations, and execute subprocesses (codex, curl).
Sanitization: While scripts/codex-imagegen/main.ts sanitizes file paths for shell metacharacters before they are passed to the Codex agent, there is no broader sanitization or validation performed on the natural language instructions extracted from user-supplied files.
[PRIVILEGE_ESCALATION]: The codex-cli provider implementation in scripts/codex-imagegen/spawn.ts invokes the codex exec command with the --sandbox danger-full-access flag. This grants the underlying agent full access to the user's environment to perform file operations, which represents a high-privilege execution state compared to standard restricted sandboxes.

baoyu-image-gen