The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a shell command by resolving a local engine path and passing user-provided arguments (kind and prompt) directly into a bash invocation. This pattern creates a risk of command injection if the user-supplied strings contain shell metacharacters like semicolons or pipes.
Evidence: bash "$ENGINE" <kind> --prompt "<compiled visual brief>" in SKILL.md.
[EXTERNAL_DOWNLOADS]: If the required engine is not found locally, the skill instructs the user or agent to install an external package using npx. While the package originates from the same author, this involves fetching and executing code from a remote repository.
Evidence: npx skills add kedoupi/tzai-image-skill -g --skill tzai-image -y in SKILL.md.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data (the image description) and interpolates it into a high-capability shell execution environment.
Ingestion points: The kind and prompt arguments provided by the user (SKILL.md).
Boundary markers: None present; the input is wrapped in quotes but not sanitized for shell-breaking characters.
Capability inventory: Shell command execution via bash (SKILL.md).
Sanitization: No escaping or validation of user-provided strings is documented before they are passed to the shell.

tzai-photo