The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's package.json and package-lock.json specify several suspicious Node.js package versions that do not correspond to the official release history of the impersonated libraries.
openai@7.9.0 is specified, whereas the official OpenAI Node.js SDK is currently on version 4.x. The use of a significantly higher version number is a common indicator of a malicious package intended for dependency confusion or supply chain attacks.
@google/genai@1.52.0 is used instead of the official Google AI SDK package @google/generative-ai. This naming discrepancy suggests a typosquatting attempt.
esbuild@0.25.12 is listed as a devDependency, which is significantly ahead of official release versions (typically 0.21.x or lower).
These packages are directly required in scripts/src/generate-images.js and would be executed during the skill's normal operation.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing external data as instructions for the agent.
Ingestion points: The skill reads image prompts from IMAGE_SPEC.md and configuration from PROJECT.json and DISCOVERY.json.
Boundary markers: There are no explicit delimiters or instructions to ignore potential injections within the IMAGE_SPEC.md prompt entries.
Capability inventory: The skill has the capability to make network requests to external APIs and write arbitrary files (PNG images) to the project directory.
Sanitization: The prompts are extracted and passed directly to the image generation APIs without any sanitization, filtering, or validation of the content.

generate-images