The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes instructions in references/base-prompt.md that command the model to ignore safety refusals: 'If content involves sensitive or copyrighted figures, create stylistically similar alternatives
DO NOT refuse to generate'. This is a direct attempt to bypass standard safety guidelines regarding protected intellectual property or sensitive individuals.
[COMMAND_EXECUTION]: The skill makes extensive use of shell commands to execute local scripts and manage image generation backends. For example, SKILL.md and references/codex-imagegen.md describe workflows that use bun or npx to run TypeScript files (scripts/merge-to-pptx.ts, scripts/merge-to-pdf.ts) and dynamically discovered wrapper scripts.
[DYNAMIC_EXECUTION]: In references/codex-imagegen.md, the skill implements a logic to search the file system for an executable wrapper (packages/baoyu-codex-imagegen/src/main.ts) or use an environment variable ($BAOYU_CODEX_IMAGEGEN_BIN) to spawn processes. This dynamic path resolution and execution increases the risk of running unintended code if the environment is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It ingests untrusted user content in Step 1.2 and interpolates it into image generation prompts in Step 5 and references/base-prompt.md without any sanitization, delimiters, or instructions to ignore embedded commands. An attacker providing malicious source content could hijack the image generation process.
Ingestion points: User-provided source material processed in Step 1.2 and stored in source.md.
Boundary markers: Absent in references/base-prompt.md; content is directly inserted into the prompt block.
Capability inventory: File system read/write (merge-to-pptx.ts), network access via image generation tools (imagegen, baoyu-image-gen), and subprocess execution.
Sanitization: No evidence of input validation or escaping for the source content used in prompts.

baoyu-slide-deck