The Agent Skills Directory

[SAFE]: The skill is well-structured and follows a least-privilege approach by defaulting to built-in tools and requiring explicit user consent before utilizing the local CLI fallback. It provides clear guidance on secure management of API keys via environment variables.\n- [COMMAND_EXECUTION]: The skill includes a local script, scripts/image_gen.py, which is used for advanced image generation and editing tasks via the command line. This script is well-documented, avoids dangerous functions like eval() or exec(), and performs thorough validation on user-provided arguments.\n- [EXTERNAL_DOWNLOADS]: The skill references standard Python dependencies including openai and pillow. These are well-known, reputable libraries from established organizations and are used appropriately for interacting with the OpenAI API and performing image downscaling.\n- [PROMPT_INJECTION]: The static analysis identified prompt injection patterns in references/evals.yaml. However, these are strictly test cases used to evaluate the agent's robustness against injection attacks and do not represent malicious instructions for the agent to execute during normal operation.\n- [INDIRECT_PROMPT_INJECTION]: The generate-batch feature in the fallback CLI script represents a potential ingestion point for untrusted data if used with third-party JSONL files.\n
Ingestion points: scripts/image_gen.py processes prompts and configuration from JSONL files provided via the --input flag.\n
Boundary markers: None present; prompts are treated as raw input for the image model.\n
Capability inventory: The script can write to the local filesystem and make network requests to the OpenAI API.\n
Sanitization: The script validates structured API parameters (size, quality, etc.) but does not sanitize the content of the prompt strings themselves, as they are intended to be processed by the image generation model.

imagegen