The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads generated image assets from the HiAPI CDN and fetches version information and update policies from the vendor's official GitHub repository.
[COMMAND_EXECUTION]: The skill includes a local installation script (scripts/install.mjs) for setting up the skill. It also provides an update command that uses npx to download and execute the latest installer from the vendor's GitHub repository.
[DATA_EXFILTRATION]: To perform its primary function, the skill transmits user prompts and image references to the vendor's API at api.hiapi.ai. This requires an API key provided via environment variables.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input (prompts and image URLs) which are processed by an external AI model, representing a standard attack surface for indirect prompt injection.
Ingestion points: User-provided prompt string and image_urls array in scripts/hiapi-gpt-image-2-5.mjs.
Boundary markers: Usage boundaries and validation rules are defined in SKILL.md and enforced within the library scripts.
Capability inventory: The skill has the ability to make network requests and write files to the local outputs/ directory.
Sanitization: Input prompts are trimmed for whitespace, and image URLs are validated for protocol and structure.

hiapi-gpt-image-2-5