The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill ingests data from a project file and uses it to construct prompts for an AI image generation API.
Ingestion points: The IMAGE_SPEC.md file is parsed in scripts/generate-images.js to extract image generation prompts.
Boundary markers: Absent. The prompts are extracted directly from the markdown structure without delimiters or instructions to ignore embedded commands.
Capability inventory: The skill performs network requests to the Gemini API and writes binary data to the local filesystem using fs.writeFileSync.
Sanitization: The skill implements directory traversal protection in the safeOutPath function to ensure files are only written within the project directory, though it does not sanitize the text prompts themselves.
[COMMAND_EXECUTION]: The skill executes npm install and node scripts to manage its dependencies and perform its primary image generation function. These operations are limited to the skill's internal directory and the project's image folder.
[EXTERNAL_DOWNLOADS]: The skill downloads the @google/genai library from the official npm registry. This package is maintained by a well-known service provider.

generate-images