The Agent Skills Directory

[SAFE]: The skill implements a robust configuration system using EXTEND.md files located in standard directories like .baoyu-skills/ or the user's home directory. This is a standard design pattern for managing user preferences and does not introduce persistence or privilege escalation risks.
[DATA_EXFILTRATION]: A specific safety directive in the skill instructions requires the agent to strip all credentials, API keys, tokens, and secrets from source content before including it in any outputs. This serves as a significant safeguard against accidental data exposure.
[COMMAND_EXECUTION]: The skill facilitates image rendering by invoking local tools and scripts, such as baoyu-image-gen and a codex-imagegen wrapper. The invocation logic is confined to the skill's own package hierarchy or paths defined in environment variables, ensuring that command execution remains within a controlled scope.
[EXTERNAL_DOWNLOADS]: To ensure compatibility across different environments, the skill references npx -y bun as a fallback method for running its internal scripts. This utilizes well-known package management utilities to maintain functional reliability without introducing unverifiable dependencies.

baoyu-infographic