The Agent Skills Directory

[SAFE]: The skill implements a robust configuration management system using environment variables and a local EXTEND.md file to store user preferences and API provider settings. This follows standard security best practices for handling secrets without hardcoding them.
[SAFE]: Network communication is exclusively directed at well-known, legitimate AI service providers including OpenAI, Google, Microsoft Azure, Alibaba Cloud (DashScope), and Replicate. All target domains are established technology services.
[SAFE]: The use of Base64 encoding throughout the codebase is strictly limited to the necessary processing of binary image data for transmission to and from APIs, which is the primary function of the skill.
[SAFE]: Dynamic module loading in the main script is restricted to a hardcoded mapping of known provider modules, preventing arbitrary file inclusion or execution of untrusted local code.
[SAFE]: Subprocess execution (using curl) is utilized only in the Google provider module as a documented workaround for specific networking issues with HTTP proxies and does not involve piping untrusted remote content to a shell.
[SAFE]: The skill's behavior is consistent with its stated purpose of providing a unified CLI for various image generation APIs, with clear documentation and appropriate error handling.

baoyu-imagine