The Agent Skills Directory

[SAFE]: The skill uses Node.js built-in modules and does not require external dependencies, which significantly reduces the potential for supply chain attacks.
[SAFE]: The skill implements a robust provider endpoint validation mechanism. When overriding default API base URLs via environment variables (e.g., GENERATING_IMAGES_GEMINI_BASE_URL), the script verifies that the URL uses the https protocol or is a local loopback address, preventing the accidental exposure of API keys over insecure http connections.
[SAFE]: A multi-step approval workflow (plan command followed by generate --approved) is enforced to ensure that users are presented with pricing information and must explicitly consent before the agent incurs costs via the image generation APIs.
[SAFE]: The script uses path.resolve() for output file paths and automatically generates sidecar JSON files to store metadata (provider, model, prompt, and date), promoting transparency and provenance for AI-generated assets.
[SAFE]: The skill instructions and scripts include clear guidelines for handling content moderation, instructing the agent to rewrite prompts instead of attempting to bypass filters.

generating-images