The Agent Skills Directory

[COMMAND_EXECUTION]: The skill contains a shell script to locate a local executable named tzai-image across several standard hidden directories in the user's home directory (e.g., ~/.agents, ~/.claude).
[COMMAND_EXECUTION]: The agent is instructed to execute the discovered engine using bash, passing user-provided prompts as arguments. While user input is interpolated into the command, it is wrapped in double quotes to mitigate basic shell injection, representing a standard CLI integration pattern.
[EXTERNAL_DOWNLOADS]: If the required engine is missing, the skill suggests an installation command using npx to fetch a package from the author's repository (kedoupi/tzai-image-skill). This is a documented setup procedure for the vendor's toolset.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input to build image prompts which are then passed to a shell-based engine.
Ingestion points: User-provided themes and visual descriptions in the prompt argument.
Boundary markers: The prompt is encapsulated in double quotes within the bash command template.
Capability inventory: File system access (writing PNG images) and command execution via the tzai-image script.
Sanitization: The skill relies on the agent to compile a 'visual brief' rather than passing raw user input directly, which provides a layer of interpretation.

tzai-social